Winlogbeat

https://www.elastic.co/guide/en/beats/winlogbeat/current/
Admin
Winlogbeat is a lightweight data shipper that collects Windows event logs and sends them to...
Tokens:115,642
Snippets:1,988
Trust Score:10
Update:5 months ago
Show doc for...
Tokens:
Raw
### Run Winlogbeat Setup Command

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/could-not-locate-index-pattern.html

If Winlogbeat fails to create the index pattern, try running the setup command again. This is the first step in resolving the 'could not locate index-pattern' error.

```bash
./winlogbeat setup
```

--------------------------------

### Full DNS Reverse Lookup Configuration Example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/processor-dns.html

This example demonstrates all available options for the DNS processor, including action, transport, detailed cache settings, nameservers, timeout, and failure tagging.

```yaml
processors:
- dns:
    type: reverse
    action: append
    transport: tls
    fields:
      server.ip: server.domain
      client.ip: client.domain
    success_cache:
      capacity.initial: 1000
      capacity.max: 10000
      min_ttl: 1m
    failure_cache:
      capacity.initial: 1000
      capacity.max: 10000
      ttl: 1m
    nameservers: ['192.0.2.1', '203.0.113.1']
    timeout: 500ms
    tag_on_failure: [_dns_reverse_lookup_failed]
	
```

--------------------------------

### Start Winlogbeat Service

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/directory-layout.html

This command starts the Winlogbeat service. Ensure Winlogbeat is installed as a service for this command to work.

```powershell
Start-Service winlogbeat
		
```

--------------------------------

### Load ingest pipelines using the setup command

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/load-ingest-pipelines.html

Run the `setup` command with the `--pipelines` option to load ingest pipelines automatically when Elasticsearch is configured as the output. Ensure the user has authorization to set up Winlogbeat.

```powershell
PS > .\winlogbeat.exe setup --pipelines		

```

--------------------------------

### Manually Load Index Template with Setup Command

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html

Load the index template manually using the `winlogbeat.exe setup` command. Requires a connection to Elasticsearch. Temporarily disable other outputs and enable Elasticsearch using `-E` flags if necessary.

```powershell
PS > .\winlogbeat.exe setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'
```

--------------------------------

### Example event with added tags

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/add-tags.html

This is an example of an event after the add_tags processor has been applied, showing the 'environment' field populated with the specified tags.

```json
{
  "environment": ["web", "production"]
}		
```

--------------------------------

### Example Winlogbeat Configuration Paths

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-path.html

This example shows the default configuration for Winlogbeat's home, config, data, and logs paths. These settings define the base directories for Winlogbeat's operations.

```yaml
path.home: /usr/share/beat
path.config: /etc/beat
path.data: /var/lib/beat
path.logs: /var/log/
		
```

--------------------------------

### Start Winlogbeat Service

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html

Starts the Winlogbeat service on Windows. Ensure user credentials in winlogbeat.yml are correctly configured.

```powershell
PS C:\Program Files\Winlogbeat> Start-Service winlogbeat		
```

--------------------------------

### Setup Winlogbeat Index Management

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html

Sets up Elasticsearch index management components, including template, ILM policy, and write alias.

```bash
winlogbeat setup --index-management
```

--------------------------------

### Example Winlogbeat Stats Output

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/http-endpoint.html

This is an example of the JSON output received from the /stats endpoint. It details metrics related to the Beat itself, libbeat, and the system.

```json
{
  "beat": {
    "cpu": {
      "system": {
        "ticks": 1710,
        "time": {
          "ms": 1712
        }
      },
      "total": {
        "ticks": 3420,
        "time": {
          "ms": 3424
        },
        "value": 3420
      },
      "user": {
        "ticks": 1710,
        "time": {
          "ms": 1712
        }
      }
    },
    "info": {
      "ephemeral_id": "ab4287c4-d907-4d9d-b074-d8c3cec4a577",
      "uptime": {
        "ms": 195547
      }
    },
    "memstats": {
      "gc_next": 17855152,
      "memory_alloc": 9433384,
      "memory_total": 492478864,
      "rss": 50405376
    },
    "runtime": {
      "goroutines": 22
    }
  },
  "libbeat": {
    "config": {
      "module": {
        "running": 0,
        "starts": 0,
        "stops": 0
      },
      "scans": 1,
      "reloads": 1
    },
    "output": {
      "events": {
        "acked": 0,
        "active": 0,
        "batches": 0,
        "dropped": 0,
        "duplicates": 0,
        "failed": 0,
        "total": 0
      },
      "read": {
        "bytes": 0,
        "errors": 0
      },
      "type": "elasticsearch",
      "write": {
        "bytes": 0,
        "errors": 0
      }
    },
    "pipeline": {
      "clients": 6,
      "events": {
        "active": 716,
        "dropped": 0,
        "failed": 0,
        "filtered": 0,
        "published": 716,
        "retry": 278,
        "total": 716
      },
      "queue": {
        "acked": 0
      }
    }
  },
  "system": {
    "cpu": {
      "cores": 4
    },
    "load": {
      "1": 2.22,
      "15": 1.8,
      "5": 1.74,
      "norm": {
        "1": 0.555,
        "15": 0.45,
        "5": 0.435
      }
    }
  }
}
```

--------------------------------

### Processor chain example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/filtering-and-enhancing-data.html

Illustrates the sequential execution of processors on an event.

```text
event -> processor 1 -> event1 -> processor 2 -> event2 ...
```

--------------------------------

### Get Event Log Providers with PowerShell

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html

Example of using PowerShell to list providers associated with a specific Windows event log.

```powershell
PS C:\> (Get-WinEvent -ListLog Security).ProviderNames
DS
LSA
SC Manager
Security
Security Account Manager
ServiceModel 4.0.0.0
Spooler
TCP/IP
VSSAudit
Microsoft-Windows-Security-Auditing
Microsoft-Windows-Eventlog
		
```

--------------------------------

### Setup Winlogbeat Dashboards

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html

Sets up the Kibana dashboards for Winlogbeat. This option loads dashboards from the Winlogbeat package.

```bash
winlogbeat setup --dashboards
```

--------------------------------

### Setup Winlogbeat Assets

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html

Loads the recommended index template, ingest pipelines, and sample dashboards for Winlogbeat data. Requires a connection to Elasticsearch or Elastic Cloud.

```powershell
PS > .\winlogbeat.exe setup -e		
```

--------------------------------

### Install Winlogbeat service

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html

Run these commands in a PowerShell prompt as Administrator to install the Winlogbeat service. If script execution is disabled, you may need to set the execution policy for the current session.

```powershell
PS C:\Users\Administrator> cd 'C:\Program Files\Winlogbeat'
PS C:\Program Files\Winlogbeat> .\install-service-winlogbeat.ps1
```

--------------------------------

### Example Winlogbeat metrics log line

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-logging.html

An example of a log line showing Winlogbeat's internal metrics that have changed in the last period. This behavior is enabled by default.

```log
2017-12-17T19:17:42.667-0500    INFO    [metrics]       log/log.go:110  Non-zero metrics in the last 30s: beat.info.uptime.ms=30004 beat.memstats.gc_next=5046416

```

--------------------------------

### Install Index Template Manually via REST API

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html

Install the exported index template into Elasticsearch using `Invoke-RestMethod`. Ensure the Elasticsearch host and port are correct.

```powershell
PS > Invoke-RestMethod -Method Put -ContentType "application/json" -InFile winlogbeat.template.json -Uri http://localhost:9200/_index_template/winlogbeat-9.3.4
```

--------------------------------

### Test Winlogbeat configuration

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/yaml-tips.html

Run this command to verify that your winlogbeat.yml configuration file has valid syntax. Ensure you are in the directory where the Winlogbeat binary is installed.

```bash
winlogbeat test config -c winlogbeat.yml
		
```

--------------------------------

### Dissect Example with Data Type Conversion and Root Target

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/dissect.html

This example demonstrates splitting a message field into structured fields, including converting a PID to an integer and placing the extracted fields at the root of the event. Use ECS-compatible field names when possible.

```yaml
processors:
  - dissect:
      tokenizer: '"%{service.pid|integer} - %{service.name} - %{service.status}"'
      field: "message"
      target_prefix: ""
		
```

--------------------------------

### Basic Info Response

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/http-endpoint.html

Example JSON response from the basic info endpoint, showing Beat details like name, hostname, and version.

```json
{
  "beat": "winlogbeat",
  "hostname": "example.lan",
  "name": "example.lan",
  "uuid": "34f6c6e1-45a8-4b12-9125-11b3e6e89866",
  "version": "8.19.14"
}
```

--------------------------------

### Example Kerberos Output Configuration

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-kerberos.html

Configure Kerberos password-based authentication for Elasticsearch output. Ensure the `config_path` points to your `krb5.conf` file.

```yaml
output.elasticsearch.hosts: ["http://my-elasticsearch.elastic.co:9200"]
output.elasticsearch.kerberos.auth_type: password
output.elasticsearch.kerberos.username: "elastic"
output.elasticsearch.kerberos.password: "changeme"
output.elasticsearch.kerberos.config_path: "/etc/krb5.conf"
output.elasticsearch.kerberos.realm: "ELASTIC.CO"
		
```

--------------------------------

### Get Help for Winlogbeat Command

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html

Shows help for any Winlogbeat command. If no command is specified, it defaults to showing help for the 'run' command.

```bash
winlogbeat help export
```

--------------------------------

### Example Host Metadata Output

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/add-host-metadata.html

This JSON structure shows the typical fields added to an event by the add_host_metadata processor, including host OS details, IP addresses, MAC addresses, and geo-location.

```json
{
   "host":{
      "architecture":"x86_64",
      "name":"example-host",
      "id":"",
      "os":{
         "family":"darwin",
         "type":"macos",
         "build":"16G1212",
         "platform":"darwin",
         "version":"10.12.6",
         "kernel":"16.7.0",
         "name":"Mac OS X"
      },
      "ip": ["192.168.0.1", "10.0.0.1"],
      "mac": ["00:25:96:12:34:56", "72:00:06:ff:79:f1"],
      "geo": {
          "continent_name": "North America",
          "country_iso_code": "US",
          "region_name": "New York",
          "region_iso_code": "NY",
          "city_name": "New York",
          "name": "nyc-dc1-rack1",
          "location": "40.7128, -74.0060"
        }
   }
}
		
```

--------------------------------

### Append Processor Example Output

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/append.html

This JSON demonstrates the result of the append processor configuration, showing how values from specified fields and static values are added to the target field.

```json
{
  "concrete": {
    "field": "val0"
  },
  "array": {
      "one": [ "val1", "val2" ]
  },
  "target-field": [
    "val0",
    "val1",
    "val2",
    "static-value"
  ]
}
		
```

--------------------------------

### Regexp Condition Example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/defining-processors.html

Use the 'regexp' condition to match a field against a regular expression. This example checks if the process name starts with 'foo'.

```yaml
regexp:
  system.process.name: "^foo.*"
		
```

--------------------------------

### Syslog Message Input Example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/syslog.html

An example of a JSON object containing a syslog message in RFC 5424 format.

```json
{
  "message": "<165>1 2022-01-11T22:14:15.003Z mymachine.example.com eventslog 1024 ID47 [exampleSDID@32473 iut=\"3\" eventSource=\"Application\" eventID=\"1011\"][examplePriority@32473 class=\"high\"] this is the message"
}
		
```

--------------------------------

### Create Winlogbeat Keystore

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html

Creates a keystore to hold secrets. Use the --force flag to overwrite the existing keystore.

```bash
winlogbeat keystore create
```

--------------------------------

### Equals Condition Example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/defining-processors.html

Use the 'equals' condition to check if a field matches a specific integer or string value. This example checks for an HTTP response code of 200.

```yaml
equals:
  http.response.code: 200
		
```

--------------------------------

### Load dashboards with Winlogbeat (MacOS/Linux)

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/load-kibana-dashboards.html

Execute this command to load the recommended index template and sample dashboards for visualizing data in Kibana. Ensure Kibana is running and credentials are configured if using a secured instance.

```bash
./winlogbeat setup --dashboards		

```

```bash
./winlogbeat setup --dashboards		

```

--------------------------------

### Load dashboards with Winlogbeat (DEB/RPM)

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/load-kibana-dashboards.html

Use this command to load the recommended index template and sample dashboards for visualizing data in Kibana. Ensure Kibana is running and credentials are configured if using a secured instance.

```bash
winlogbeat setup --dashboards		

```

```bash
winlogbeat setup --dashboards		

```

--------------------------------

### Configure Sysmon Event Log Input

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-module-sysmon.html

Configure Winlogbeat to read from the Sysmon operational channel. Ensure Sysmon is installed independently. A restart of Winlogbeat is required after installing Sysmon.

```yaml
winlogbeat.event_logs:
  - name: Microsoft-Windows-Sysmon/Operational

output.elasticsearch.pipeline: winlogbeat-%{[agent.version]}-routing
		
```

--------------------------------

### Create a Winlogbeat keystore

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/keystore.html

Use this command to create a new secrets keystore. The keystore is created in the directory specified by the `path.data` configuration setting.

```bash
winlogbeat keystore create
		

```

--------------------------------

### Contains Condition Example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/defining-processors.html

Use the 'contains' condition to check if a string value is present within a field, which can be a string or an array of strings. This example checks for a specific error in the transaction status.

```yaml
contains:
  status: "Specific error"
		
```

--------------------------------

### Load dashboards with Winlogbeat (Docker)

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/load-kibana-dashboards.html

Run this Docker command to load the recommended index template and sample dashboards for visualizing data in Kibana. Ensure Kibana is running and credentials are configured if using a secured instance.

```bash
docker run --rm --net="host" docker.elastic.co/beats/winlogbeat:9.3.4 setup --dashboards		

```

--------------------------------

### Run Winlogbeat

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-geoip.html

Execute Winlogbeat from the command line. Use `sudo` if the configuration file is owned by root. This command starts Winlogbeat with the configured settings, including the Elasticsearch output and the geoip ingest pipeline.

```bash
./winlogbeat -e

```

--------------------------------

### Winlogbeat Error Message Example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/publishing-ls-fails-connection-reset-by-peer.html

This is an example of the error message you might see when Winlogbeat fails to publish events due to a connection reset by the peer. Ensure your firewall is not interfering with the TCP connection.

```text
Failed to publish events caused by: write tcp ... write: connection reset by peer
		

```

--------------------------------

### Load dashboards with Winlogbeat (Windows)

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/load-kibana-dashboards.html

Open a PowerShell prompt as an Administrator and navigate to the Winlogbeat directory. Run this command to load the recommended index template and sample dashboards for visualizing data in Kibana. Ensure Kibana is running and credentials are configured if using a secured instance.

```powershell
PS > .\winlogbeat.exe setup --dashboards		

```

--------------------------------

### Decode XML with error and missing field handling

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/decode-xml.html

Decodes XML from the `example` field, writing to the `xml` field. It ignores errors if the `example` field is missing or if any decoding errors occur during processing.

```yaml
processors:
  - decode_xml:
      field: example
      target_field: xml
      ignore_missing: true
      ignore_failure: true
		
```

--------------------------------

### Configure Kafka Output with Topic Rules

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/kafka-output.html

Set up Kafka output with multiple topic rules. Winlogbeat selects the topic based on the first matching rule, allowing for conditional topic assignment.

```yaml
output.kafka:
  hosts: ["localhost:9092"]
  topic: "logs-%{[agent.version]}"
  topics:
    - topic: "critical-%{[agent.version]}"
      when.contains:
        message: "CRITICAL"
    - topic: "error-%{[agent.version]}"
      when.contains:
        message: "ERR"
		
```

--------------------------------

### Winlogbeat help command

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html

Shows help for any command. If no command is specified, shows help for the `run` command.

```APIDOC
## `help` command

Shows help for any command. If no command is specified, shows help for the `run` command.
**SYNOPSIS**
```
winlogbeat help COMMAND_NAME [FLAGS]
		
```


**`COMMAND_NAME`**
     Specifies the name of the command to show help for.
**FLAGS** 

**`-h, --help`**
     Shows help for the `help` command.
Also see Global flags.
**EXAMPLE**
```
winlogbeat help export
		
```
```

--------------------------------

### Syslog Processor Metrics Example

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/syslog.html

Example metrics from a syslog processor with a tag 'log-input' and instance ID '1'. These metrics help in debugging parsing failures, missing fields, and successful message processing.

```json
{
  "processor": {
    "syslog": {
      "log-input-1": {
        "failure": 10,
        "missing": 0,
        "success": 3
      }
    }
  }
}
		
```

--------------------------------

### Enable beat-xpack module in Metricbeat

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/monitoring-metricbeat-collection.html

Run this command to enable the beat-xpack module in Metricbeat. Ensure you use the correct command syntax for your operating system.

```bash
metricbeat modules enable beat-xpack
		
```

--------------------------------

### Disable ILM setup check in Winlogbeat

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/privileges-to-publish-events.html

When using Index Lifecycle Management (ILM) with Winlogbeat, disable the ILM setup check in the Winlogbeat configuration file before publishing events to prevent potential conflicts.

```yaml
setup.ilm.check_exists: false
		
```

--------------------------------

### Execute Winlogbeat with EVTX Input

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html

Run Winlogbeat with the custom configuration file and specify the .evtx file path using the `EVTX_FILE` environment variable. Winlogbeat will exit upon completion.

```bash
.\winlogbeat.exe -e -c .\winlogbeat-evtx.yml -E EVTX_FILE=c:\backup\Security-2019.01.evtx
		
```

--------------------------------

### Configure translate_ldap_attribute Processor

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/processor-translate-guid.html

Use this processor to translate Active Directory GUIDs to human-readable names. Configure the source field, and optionally target field, domain, and connection details. Set `ignore_missing` or `ignore_failure` to handle cases where the GUID is not found or the translation fails.

```yaml
processors:
  - translate_ldap_attribute:
      field: winlog.event_data.ObjectGuid
      ignore_missing: true
      ignore_failure: true
      # ldap_domain: "example.com"  # Optional - override the OS-discovered domain used for SRV/LOGONSERVER hints
      # ldap_address: "ldap://ds.example.com:389"
      # ldap_base_dn: "dc=example,dc=com"
		

```

--------------------------------

### Configure beat-xpack module in Metricbeat

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/monitoring-metricbeat-collection.html

Configure the beat-xpack module by editing the `modules.d/beat-xpack.yml` file. Adjust `hosts`, `username`, and `password` as needed for your environment. Defaults are recommended for other settings.

```yaml
- module: beat
  metricsets:
    - stats
    - state
  period: 10s
  hosts: ["http://localhost:5066"]
  #username: "user"
  #password: "secret"
  xpack.enabled: true
		
```

--------------------------------

### List Keys in Winlogbeat Keystore

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/command-line-options.html

Lists all the keys currently stored in the Winlogbeat keystore.

```bash
winlogbeat keystore list
```

--------------------------------

### Test Winlogbeat Configuration

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html

Test the Winlogbeat configuration file to ensure it is valid before starting the service.

```powershell
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e
```

--------------------------------

### Example of copied fields

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/copy-fields.html

This JSON shows the result of the copy_fields processor, where the 'message' field has been copied to 'event.original'.

```json
{
  "message": "my-interesting-message",
  "event": {
      "original": "my-interesting-message"
  }
}
		
```

--------------------------------

### Process metadata fields

Source: https://www.elastic.co/guide/en/beats/winlogbeat/current/add-process-metadata.html

Example of fields added to an event by the add_process_metadata processor, including container and process details.

```json
{
  "container": {
    "id": "b5285682fba7449c86452b89a800609440ecc88a7ba5f2d38bedfb85409b30b1"
  },
  "process": {
    "args": [
      "/usr/lib/systemd/systemd",
      "--switched-root",
      "--system",
      "--deserialize",
      "22"
    ],
    "executable": "/usr/lib/systemd/systemd",
    "name": "systemd",
    "owner": {
      "id": "0",
      "name": "root"
    },
    "parent": {
      "pid": 0
    },
    "pid": 1,
    "start_time": "2018-08-22T08:44:50.684Z",
    "title": "/usr/lib/systemd/systemd --switched-root --system --deserialize 22"
  }
}
	
```
Tokens:
Raw