Winlogbeat only last log shows in Kibana

Elastic Stack Beats
1

Hi all, I am trying to setup my elastic server running logstash, kibana and elasticsearch (installed via a binami package)

Everything is running ok but when trying to gather windows logs from a machine using winlogbeat it seems a log is only coming through once every 24 hours, so when i goto create the index it only shows one log per day, which is also reflected in the discovery tab, with the @timestamp selected on the index i only ever see one log on the screen.

the winlogbeat setup is very basic

winlogbeat.event_logs:

  • name: Application
    ignore_older: 48h
  • name: Security
    ignore_older: 48h
  • name: System
    ignore_older: 48h

the only other part setup was the logstash output which is as follows

output.logstash:
hosts: ["my.ip.address.here:5044"]

am i missing something fundamental ? i am very new to all this - all running on Windows server by the way.

Should i be sending to logstash or elastic search in the yml file for winlogbeat?

Thanks in advance

2

What does your Logstash config look like?

3

Hi Christian,

So i havent configured anything for Logstash, only for the winlogbeat agent on the server to monitor, maybe this is what I am missing but nothing so far in the reading has mentioned this ?

so to answer your question it would be completely default at the moment. I've found the yml file in the logstash config directory and everything is currently commented out.

4

oh ok maybe we are getting somewhere - if i change winlogbeat to send straight to elasticsearch and not logstash everything is now coming through, the indexing also shows winlogbeat and not logstash.

so do I leave it as this or should i be sending it via logstash ?

thanks

5

You can do either. This blog post shows how the Elastic Stack scales and how the different pieces fit together.

6

thanks, ill take a look. Do you have any good resources for learning how to visualise the data? so for example i would like to see failed logon attempts and times or those attempts etc ?

thanks again.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.