Winlogbeat and Scheduled Task Logs (or others)


(Wylie Bayes) #1

Could someone possibly assist me in capturing Schedule Task logs with Winlogbeat?

Right now my config is like this:

winlogbeat.event_logs:
- name: Application
ignore_older: 72h
- name: Security
- name: System
- name: "Windows Powershell"
- name: Microsoft/Windows/TaskScheduler/Operational

I have tried wrapping in quotes like i did with with the Powershell log but it doesn't seem to make a difference... If someone could help me with the proper syntax for how to do this I would be very greatful.

Thanks in advance!

-Wylie


(Wylie Bayes) #2

I also tried: Microsoft-Windows-TaskScheduler/Operational - can't see any logs tho.


(Wylie Bayes) #3

Got it to work with: - name: "Mirosoft-Windows-TaskScheduler/Operational"

Please close this thread!


(Andrew Kroh) #4

I was going to have you run

PS C:\> Get-WinEvent -ListLog * | Format-List -Property LogName

to check the name.

Glad you fixed it.

Reference: https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#configuration-winlogbeat-options-event_logs-name


(Wylie Bayes) #5

Will note that for later cases! Thanks a bunch Andrew!!


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.