Windows event logs with Winlogbeat

Open in ChatGPTOpen in Claude

Coralogix integrates with Winlogbeat so you can send your Windows Event Viewer logs directly to Coralogix and parse them according to your needs.

What you need

1. Winlogbeat installed on the Windows system to monitor.

2. A Logstash instance that you run in your own infrastructure, configured to receive Beats input and forward it to Coralogix. Coralogix no longer hosts a Logstash server for Beats shippers. See Run your own Logstash instance for the Logstash input, filter, and output configuration.

Private Key: Your Send-Your-Data API key is a unique ID that represents your company.

Application Name: The name of your main application, for example, a company named "SuperData" would probably insert the "SuperData" string parameter, or if they would like to debug their test environment they might insert something like "SuperData-Test".

Subsystem Name: Your application probably has multiple Subsystems; for example: Backend-Servers, Middleware, Frontend-Servers, etc. Inserting the SubSystem Name facilitate your data's examination.

Configuration

1. In this example Winlogbeat sends Application, System, and Security Windows logs to your own Logstash instance. Adjust this configuration file to match the address of your Logstash instance.

#=========================== Winlogbeat Event Logs ============================
winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security

#----------------------------- Logstash output --------------------------------
output.logstash:
    enabled: true
    hosts: ["<logstash-ip-address>:5044"]

Note

The Coralogix-hosted Logstash endpoints (logstashserver.coralogix.com, logstash.coralogix.in, logstashserver.coralogix.us) are retired and no longer accept data. See Deprecation of Coralogix-hosted Logstash.

Set the Send-Your-Data API key, application name, and subsystem name in your Logstash configuration, not in winlogbeat.yml.

2. If you followed the Winlogbeat installation instructions earlier in this document, it should reside under:

C:\Program Files\Winlogbeat>

Make a backup copy of the default winlogbeat.yml file from the installation directory, then create a new winlogbeat.yml file using the code from step 1 above.

Modify this new configuration file as needed to suit your environment. Also copy the winlogbeat.yml file to the installation directory, which is the same directory where winlogbeat.exe resides.

3. To test the Winlogbeat configuration, open PowerShell in Administrator mode and issue the command:

PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e

If you receive an error, write it down and contact Coralogix Support for assistance.

4. If the winlogbeat service is installed on the Windows device you want to monitor, type the following command from an Administrator's mode PowerShell session in the directory where the install-service-winlogbeat.ps1 PowerShell script resides:

PS C:\Program Files\Winlogbeat> .\install-service-winlogbeat.ps1

5. Make sure your system is configured to run PowerShell scripts. If it is not, issue the following command from an Administrator's mode PowerShell session:

PS C:\Program Files\Winlogbeat> set-executionpolicy remotesigned

For more information, see the Set-ExecutionPolicy documentation.

6. Once the winlogbeat service is installed, start it from an Administrator's mode PowerShell session by issuing the command:

PS C:\Program Files\Winlogbeat> Start-Service winlogbeat

7. At this point, Windows Event Viewer logs stream to Coralogix. Verify them in LiveTail.