Winlogbeat and Scheduled Task Logs (or others)

(Wylie Bayes) #1

Could someone possibly assist me in capturing Schedule Task logs with Winlogbeat?

Right now my config is like this:

- name: Application
ignore_older: 72h
- name: Security
- name: System
- name: "Windows Powershell"
- name: Microsoft/Windows/TaskScheduler/Operational

I have tried wrapping in quotes like i did with with the Powershell log but it doesn't seem to make a difference... If someone could help me with the proper syntax for how to do this I would be very greatful.

Thanks in advance!


(Wylie Bayes) #2

I also tried: Microsoft-Windows-TaskScheduler/Operational - can't see any logs tho.

(Wylie Bayes) #3

Got it to work with: - name: "Mirosoft-Windows-TaskScheduler/Operational"

Please close this thread!

(Andrew Kroh) #4

I was going to have you run

PS C:\> Get-WinEvent -ListLog * | Format-List -Property LogName

to check the name.

Glad you fixed it.


(Wylie Bayes) #5

Will note that for later cases! Thanks a bunch Andrew!!

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.