Winlogbeat network port usage

Elastic Stack Beats
1

Hi, maybe daft question, but what protocol port does Winlogbeat use to send from on PCs?

2

In general Winlogbeat (and all Beats) connects to the remote destination over TCP.

Any answers above that layer depend on the output you are using, what protocol (network layer) you are asking about, and whether you have configured TLS.

3

I'm outputting direct to elasticsearch, so is there no specific send port, just the destination/listening port of 9200 then?

4

For the elasticsearch output (without TLS) the transport protocol and destination port is tcp/9200. The source port is ephemeral. The application layer protocol is HTTP.

5

Thanks Andrew, needed to find out in a hurry and all sorted now.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.