Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Winlogbeat] Add option to read .evt and .evtx files #4450

Closed
ghost opened this issue Jun 2, 2017 · 2 comments · Fixed by #11361
Closed

[Winlogbeat] Add option to read .evt and .evtx files #4450

ghost opened this issue Jun 2, 2017 · 2 comments · Fixed by #11361
Labels
enhancement v7.2.0 :Windows Winlogbeat

Comments

@ghost
Copy link

ghost commented Jun 2, 2017

Would it be possible to have a functionality which would allow to read .evt files directly ?
Something like :

winlogbeat:
prospectors:
- input_type: winlog
paths:
- C:\System32\Winevt\Logs\ *.evt
@andrewkroh andrewkroh changed the title Option to point at .evt files inside winlogbeat [Winlogbeat] Add option to read .evt or .evtx files Sep 18, 2018
@andrewkroh andrewkroh changed the title [Winlogbeat] Add option to read .evt or .evtx files [Winlogbeat] Add option to read .evt and .evtx files Sep 18, 2018
@andrewkroh
Copy link
Member

What are the use cases for reading from .evt/.evtx files?

  • Is this for loading older historical data? Like for back-filling old log data in a one-off task manner?

  • Or is there a use case where you need to continuously monitor a directory for new files?

@andrewkroh andrewkroh mentioned this issue Mar 15, 2019
Closed
@sanjay900 sanjay900 mentioned this issue Mar 15, 2019
Closed
@andrewkroh andrewkroh mentioned this issue Mar 21, 2019
Merged
2 tasks
@andrewkroh
Copy link
Member

I've opened a PR for this at #11361.

andrewkroh added a commit to andrewkroh/beats that referenced this issue Apr 8, 2019
@andrewkroh
Read archived .evtx files with Winlogbeat
511f781 
This gives Winlogbeat the ability to read from archived .evtx files. The `name` parameter recognizes that the value is absolute path and then uses the appropriate APIs to open the file and ingest its contents. In order to support the use case of reading from a file and then exiting when there are no more events (`ERROR_NO_MORE_ITEMS`) I added a config option to change the behavior of the reader from waiting for more events to stopping.

I also had to add `shutdown_timeout` option to make Winlogbeat wait for events to finish publishing before exiting.

To keep it simple, globs are not supported. This would have required the introduction of a "prospector" to continuously monitor the glob for new / moved / deleted files.

    winlogbeat.event_logs:
      - name: ${EVTX_FILE}
        no_more_events: stop

    winlogbeat.shutdown_timeout: 30s
    winlogbeat.registry_file: evtx-registry.yml

    output.elasticsearch.hosts: ['http://localhost:9200']

Closes elastic#4450
andrewkroh added a commit that referenced this issue Apr 9, 2019
@andrewkroh
Read archived .evtx files with Winlogbeat (#11361)
dfabb06 
This gives Winlogbeat the ability to read from archived .evtx files. The `name` parameter recognizes that the value is absolute path and then uses the appropriate APIs to open the file and ingest its contents. In order to support the use case of reading from a file and then exiting when there are no more events (`ERROR_NO_MORE_ITEMS`) I added a config option to change the behavior of the reader from waiting for more events to stopping.

I also had to add `shutdown_timeout` option to make Winlogbeat wait for events to finish publishing before exiting.

To keep it simple, globs are not supported. This would have required the introduction of a "prospector" to continuously monitor the glob for new / moved / deleted files.

    winlogbeat.event_logs:
      - name: ${EVTX_FILE}
        no_more_events: stop

    winlogbeat.shutdown_timeout: 30s
    winlogbeat.registry_file: evtx-registry.yml

    output.elasticsearch.hosts: ['http://localhost:9200']

Closes #4450
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement v7.2.0 :Windows Winlogbeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Read archived .evtx files with Winlogbeat andrewkroh/beats
3 participants
@tsg @ruflin @andrewkroh