winlogbeat-收集windows事件日志并启用默认模板、dashboard相关配置
winlogbeat用于收集windows的系统事件日志;
官网安装方法:https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html
收集并写入elasticsearch配置实例:
winlogbeat.event_logs: - name: Security ignore_older: 24h event_id: 4624, 4625,4626,4627 tags: ["Security_205"] fields: type: "Security_205" log_topic: "Security_205" fields_under_root: true #修改默认的elasticsearch索引; 特别注意index中不能出现大写字母,否则会无法入es中 output.elasticsearch.index: "security_205-%{+yyyy.MM.dd}" setup.template.name: "security_205" setup.template.pattern: "security_205-*" output.elasticsearch: hosts: ["10.10.5.78:9200","10.10.5.79:9200","10.10.5.80:9200"] #使用官方的dashboard,当elasticsearch默认修改时,setup.dashboards.index也要进行修改 setup.dashboards.enabled: true setup.dashboards.index: "security_205-*" setup.kibana: host: "10.10.5.109:5601" logging.to_files: true logging.files: path: C:\Program Files\WinlogBeat\log logging.level: info
参数说明:
- name:设定收集系统事件的日志类型;
ignore_older:设定多久以前的日志不进行收集;在初次配置时十分有效;
event_id:设定收集的事件id,默认为收集所有的事件日志;
logging.to_files:开启日志相关的配置;当输output无法连接时,会暂时写入logging相关的配置中;
注:写入elasticsearch时,会启用默认的索引名字为winlogbeat-*;要修改为自己需要的名字
收集并写入kafka相关配置:
winlogbeat.event_logs: - name: Security ignore_older: 24h event_id: 4624, 4625,4626,4627 tags: ["Security_205"] fields: type: "Security_205" log_topic: "Security_205" fields_under_root: true output.kafka: enabled: true hosts: ["10.78.1.85:9092","10.78.1.87:9092","10.78.1.71:9092"] topic: "%{[log_topic]}" partition.round_robin: reachable_only: true worker: 2 required_acks: 1 compression: gzip max_message_bytes: 10000000 setup.dashboards.enabled: true setup.dashboards.index: "security_205-*" setup.kibana: host: "10.10.5.109:5601" logging.to_files: true logging.files: path: C:\Program Files\WinlogBeat\log logging.level: info
转载于:https://blog.51cto.com/liuzhengwei521/2362169