Winlogbeat is not collecting Application logs from Windows 7

Elastic Stack Elasticsearch
#1

Hello ,

I have a complete setup of ELK stack on Ubuntu server 14.04. Also I have installed winlogbeat 5.3 on another windows 7 host. winlogbeat is not collecting application logs. Only logs i could see on kibana is of winlogbeat service start and stop events. Please see the winlogbeat.yml config file.

Can you please help me out.

Thanks in advance.

#2

You need to specify the log you want to collect in the config file:

In your case, you want the Application Event logs, add this below your System entry:

  • name: Application

So, the snippet in your config file should look similar to this:

event_logs:
- name: Application
ignore_older: 72h
- name: Security
- name: System

#3

Issue resolved. Thanks.

#4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.