![](images/elastic.png)
Winlogbeat
Winlogbeat is an open source log shipper that can forward Windows event logs to LogScale.
Warning
Beats 7.16 and later Log Shippers have compatibility issues with different versions of LogScale, reporting an Invalid version from Elasticsearch error.
Beats 8.0 and higher require a configuration change to enable them to work. See Troubleshooting: Beats and Logstash Log Shippers 7.13 and higher No Longer Work with LogScale for more information.
Beats/Logstash Version | Humio 1.36 and below | Humio 1.37 |
---|---|---|
Logstash 7.16 and up | Incompatible | Compatible |
Filebeat 7 and below | Compatible | Compatible |
Winlogbeat 8.0.0 | Compatible but requires setup.ilm.enabled: false | Compatible but requires setup.ilm.enabled: false |
Winlogbeat 8.1.0 |
Compatible but requires setup.ilm.enabled: false and output.elasticsearch.allow_older_versions: true |
Compatible but requires setup.ilm.enabled: false and output.elasticsearch.allow_older_versions: true |
Installation
The instructions below are taken in part from the official Winlogbeat documentation. You might also look at their General Guide and their Getting Started Guide.
Download the latest version of Winlogbeat.
Note
You must download and install the open source version of Winlogbeat.
The download page will look like the screenshot below. The standard
version of Winlogbeat is designed to only work with Elasticsearch
and will not connect to LogScale successfully. Please make sure that
the file name of the file that you download looks like
winlogbeat-oss-7.2.0-windows-x86_64.zip
.
Extract the contents of the .zip file into
C:\Program Files\Winlogbeat
.Open a PowerShell prompt as an Administrator.
Navigate to the Winlogbeat directory
powershellPS C:\Users\Administrator>cd 'c:\Program Files\Winlogbeat'
Run the Winlogbeat installation script
powershellPS C:\Program Files\Winlogbeat> .\install-service-winlogbeat.ps1
If script execution is disabled on the system you will need to enable it for the current session using the following command:
powershellpowershell.exe -executionpolicy unrestricted -file .\install-service-winlogbeat.ps1
Configuration
![]() |
Figure 1. Start Service
The following section covers additional areas for configuration of Winlogbeat including how to add additional event logs to be sent to LogScale and how to make performance adjustments. For more information about Winlogbeat configuration, please read the Winlogbeat Configuration Options Guide.
Editing the Configuration
You must make the following changes to the configuration, see Configuration Example.
Open
winlogbeat.yml
file which you can find inC:\Program Files\Winlogbeat
.Specify the Windows logs you want to track in
winlogbeat.event_log
.Insert the URL of your LogScale installation followed by /api/v1/ingest/elastic-bulk in
hosts
.Generate and insert the Ingest Tokens from the repository as the
password
.Set
logging.to_files
totrue
.Under
logging.files
setpath
to the path in which to write the logs andlogging.level
toinfo
.Verify that your
winlogbeat.yml
file is valid using the following command in PowerShell:
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e
If your configuration is valid you can start Winlogbeat using the following command:
PS C:\Program Files\Winlogbeat> Start-Service winlogbeat
Configuration Example
The following example file collects application, system, and security data and also logs Winlogbeat's operations to disk in order to facilitate troubleshooting if needed. Update the hosts and password fields with your LogScale server's address and the ingest token for your repository.
winlogbeat.event_logs:
- name: Application
- name: System
- name: Security
output.elasticsearch:
hosts: ["http://$YOUR_LOGSCALE_URL/api/v1/ingest/elastic-bulk"]
password: "*************************************"
logging.to_files: true
logging.files:
path: C:\ProgramData\Winlogbeat\Logs
logging.level: info
Configuration Objects
The section only aims to document the set of keys and value required to ship data to LogScale and therefore not all of the configuration options which are available in Winlogbeat are listed.
See WinLogBeat Documentation for more information on configuration.
winlogbeat.event_log
The source block configures the sources of data that will be sent to LogScale.
name
The name of the windows log to ship, for example
System
. You can retrieve the full list of logs by running:
Get-WinEvent -ListLog * | Format-List -Property LogName
output.elasticsearch
hosts
The URL of your LogScale installation followed by
/api/v1/ingest/elastic-bulk
.password
The ingest token for your LogScale Repository, see Ingest Tokens for more information on generating tokens.
logging.to_files
Set the value of the field to true
to write all
logs to files. The log files are automatically rotated when the log
file size limit is reached. Note that the file is only created if
there are logs to write.
logging.files
path
The path in which the log files are created.
logging.levels
The level of logging required, which must be set to
info
.
Tuning Performance
You can tune Winlogbeat's performance by setting the
compression_level
, worker
, and
:field:`bulk_max_size values in the
output.elasticsearch
section of your
winlogbeat.yml
based on the volume of data that
you are shipping to LogScale. Below is an example
output.elasticsearch
section
output.elasticsearch:
hosts: ["http://$YOUR_LOGSCALE_URL/api/v1/ingest/elastic-bulk"]
password: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
compression_level: 5
bulk_max_size: 200
worker: 1
The ini compression_level used by all beats is 3, but it may be set from 0 (i.e., no compression) to 9 (i.e., the maximum compression). Compressing the data decreases the amount of bandwidth required to ship your data, but uses CPU and other server resources.
The worker states the number of writers (threads) that can write events to LogScale.
The
bulk_max_size
is the number of events or log entries to send in a single batch. The
bulk_max_size
should not exceed 100 to 300 events
for use with LogScale. While increasing the number increases the
throughput of ingest it has a negative impact on search performance of
the resulting events in LogScale.