Configure Winlogbeat
Before you begin, you’ll need: Winlogbeat 7 or Winlogbeat 6
Download the Logz.io public certificate
Download the
Logz.io public certificate
to C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt
on your machine.
Configure Windows input
If you’re working with the default configuration file,
(C:\Program Files\Winlogbeat\winlogbeat.yml
)
clear the contents and start with a fresh file.
Paste this code block.
Replace <<LOG-SHIPPING-TOKEN>>
with the token of the account you want to ship to.
winlogbeat.event_logs:
- name: Application
ignore_older: 72h
- name: Security
- name: System
fields:
logzio_codec: json
token: <<LOG-SHIPPING-TOKEN>>
type: wineventlog
fields_under_root: true
If you’re running Winlogbeat 7, paste this code block. Otherwise, you can leave it out.
# ... For Winlogbeat 7 only ...
processors:
- rename:
fields:
- from: "agent"
to: "beat_agent"
ignore_missing: true
- rename:
fields:
- from: "log.file.path"
to: "source"
ignore_missing: true
- rename:
fields:
- from: "log"
to: "log_information"
ignore_missing: true
Set Logz.io as the output
If Logz.io isn’t the output, set it now.
Winlogbeat can have one output only, so remove any other output
entries.
Replace <<LISTENER-HOST>>
with your region’s listener host (for example, listener.logz.io
). For more information on finding your account’s region, see Account region.
output.logstash:
hosts: ["<<LISTENER-HOST>>:5015"]
ssl:
certificate_authorities: ['C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt']
Restart Winlogbeat
Open PowerShell as an admin and run this command:
Restart-Service winlogbeat
Check Logz.io for your logs
Give your logs some time to get from your system to ours, and then open Kibana.
If you still don’t see your logs, see log shipping troubleshooting.
Configure NXLog
Before you begin, you’ll need: NXLog
Configure NXLog basics
Copy this code into your configuration file (C:\Program Files (x86)\nxlog\conf\nxlog.conf
by default).
define ROOT C:\\Program Files (x86)\\nxlog
define ROOT_STRING C:\\Program Files (x86)\\nxlog
define CERTDIR %ROOT%\\cert
Moduledir %ROOT%\\modules
CacheDir %ROOT%\\data
Pidfile %ROOT%\\data\\nxlog.pid
SpoolDir %ROOT%\\data
LogFile %ROOT%\\data\\nxlog.log
<Extension charconv>
Module xm_charconv
AutodetectCharsets utf-8, euc-jp, utf-16, utf-32, iso8859-2
</Extension>
For information on parsing multiline logs, see Parsing Multi-Line Messages from NXLog.
Add Windows as an input
Add an Input
block to append your account token to log records.
Replace <<LOG-SHIPPING-TOKEN>>
with the token of the account you want to ship to.
<Input eventlog>
# For Windows Vista/2008 and later, set Module to `im_msvistalog`. For
# Windows XP/2000/2003, set to `im_mseventlog`.
Module im_msvistalog
Exec if $raw_event =~ /^#/ drop();
Exec convert_fields("AUTO", "utf-8");
Exec $raw_event = '[<<LOG-SHIPPING-TOKEN>>][type=wineventlog]' + $raw_event;
</Input>
Set Logz.io as the output
Add the Logz.io listener in the Output
block.
Replace <<LISTENER-HOST>>
with your region’s listener host (for example, listener.logz.io
). For more information on finding your account’s region, see Account region.
<Output out>
Module om_tcp
Host <<LISTENER-HOST>>
Port 8010
</Output>
<Route 1>
Path eventlog => out
</Route>
Restart NXLog
Open PowerShell as an admin and run this command:
Restart-Service nxlog
Check Logz.io for your logs
Give your logs some time to get from your system to ours, and then open Kibana.