Winlogbeat to write output to a file

Elastic Stack Beats
1

Team,

Is there a way we can have filename dynamically picks the host.name while writing to a file ?

Something like below.

output.file:
  path: "/tmp/winlogbeat"
  filename: ***${host.name}***
2

Hi Prasad,

What you are trying to do is more a mix of linux world and try to replace beat fields with variables try.
But we talk about winlogbeat under windows.
So a path /tmp doesn't exist under windows and I think the variable you are looking for is COMPUTERNAME.
https://www.elastic.co/guide/en/beats/filebeat/current/using-environ-vars.html
So I assume you are trying to do something like this:

output.file:
  path: "${TEMP}/winlogbeat"
  filename: "${COMPUTERNAME}"

if you want to setup direct paths, then you will replace your path variable with something like that:

output.file:
  path: "c:/winlogbeat"
  filename: "${COMPUTERNAME}"
3

Hello Andre,
Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.