Winlogbeat and Scheduled Task Logs (or others)

Elastic Stack Beats
1

Could someone possibly assist me in capturing Schedule Task logs with Winlogbeat?

Right now my config is like this:

winlogbeat.event_logs:
- name: Application
ignore_older: 72h
- name: Security
- name: System
- name: "Windows Powershell"
- name: Microsoft/Windows/TaskScheduler/Operational

I have tried wrapping in quotes like i did with with the Powershell log but it doesn't seem to make a difference... If someone could help me with the proper syntax for how to do this I would be very greatful.

Thanks in advance!

-Wylie

2

I also tried: Microsoft-Windows-TaskScheduler/Operational - can't see any logs tho.

3

Got it to work with: - name: "Mirosoft-Windows-TaskScheduler/Operational"

Please close this thread!

4

I was going to have you run

PS C:\> Get-WinEvent -ListLog * | Format-List -Property LogName

to check the name.

Glad you fixed it.

Reference: https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#configuration-winlogbeat-options-event_logs-name

5

Will note that for later cases! Thanks a bunch Andrew!!