IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Step 1: Install Winlogbeat Step 3: Configure Winlogbeat to use Logstash »

› ›

Step 2: Configure Winlogbeat

edit

Step 2: Configure Winlogbeat

edit

To configure Winlogbeat, you edit the winlogbeat.yml configuration file. See the Config File Format section of the Beats Platform Reference for more about the structure of the config file.

Here is a sample of the winlogbeat.yml file:

winlogbeat.event_logs:
  - name: Application
  - name: Security
  - name: System

output.elasticsearch:
  hosts:
    - localhost:9200

logging.to_files: true
logging.files:
  path: C:\ProgramData\winlogbeat\Logs
logging.level: info

To configure Winlogbeat:

In the event_logs section, specify the event logs that you want to monitor. By default, Winlogbeat is set to monitor application, security, and system logs:
```
winlogbeat.event_logs:
  - name: Application
  - name: Security
  - name: System
```
To obtain a list of available event logs, run Get-EventLog * in PowerShell. For more information about this command, see the configuration details for event_logs.name.
Configure the output. Winlogbeat supports a variety of outputs, but typically you’ll either send events directly to Elasticsearch, or to Logstash for additional processing.

To send output directly to Elasticsearch (without using Logstash), set the location of the Elasticsearch installation:
- If you’re running our hosted Elasticsearch Service on Elastic Cloud, specify your Cloud ID. For example:
```
cloud.id: "staging:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRjZWM2ZjI2MWE3NGJmMjRjZTMzYmI4ODExYjg0Mjk0ZiRjNmMyY2E2ZDA0MjI0OWFmMGNjN2Q3YTllOTYyNTc0Mw=="
```
- If you’re running Elasticsearch on your own hardware, set the host and port where Winlogbeat can find the Elasticsearch installation. For example:
```
output.elasticsearch:
  hosts: ["myEShost:9200"]
```
  To send output to Logstash, Configure the Logstash output instead. For all other outputs, see Configure the output.

If you plan to use the sample Kibana dashboards provided with Winlogbeat, configure the Kibana endpoint. You can skip this step if Kibana is running on the same host as Elasticsearch.

setup.kibana:
  host: "mykibanahost:5601"

The hostname and port of the machine where Kibana is running, for example, mykibanahost:5601. If you specify a path after the port number, include the scheme and port: http://mykibanahost:5601/path.

If Elasticsearch and Kibana are secured, set credentials in the winlogbeat.yml config file before you run the commands that set up and start Winlogbeat.

If you’re running our hosted Elasticsearch Service on Elastic Cloud, specify your cloud auth credentials. For example:
```
cloud.auth: "elastic:YOUR_PASSWORD"
```

If you’re running Elasticsearch on your own hardware, specify your Elasticsearch and Kibana credentials:

output.elasticsearch:
  hosts: ["myEShost:9200"]
  username: "filebeat_internal"
  password: "YOUR_PASSWORD" 
setup.kibana:
  host: "mykibanahost:5601"
  username: "my_kibana_user"  
  password: "YOUR_PASSWORD"

	This examples shows a hard-coded password, but you should store sensitive values in the secrets keystore.
	The `username` and `password` settings for Kibana are optional. If you don’t specify credentials for Kibana, Winlogbeat uses the `username` and `password` specified for the Elasticsearch output.
	To use the pre-built Kibana dashboards, this user must have the `kibana_user` built-in role or equivalent privileges.

For more information, see Securing Winlogbeat.

After you save your configuration file, test it with the following command.

PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e

« Step 1: Install Winlogbeat Step 3: Configure Winlogbeat to use Logstash »