Commits on Apr 8, 2019

1. Read archived .evtx files with Winlogbeat …

   This gives Winlogbeat the ability to read from archived .evtx files. The `name` parameter recognizes that the value is absolute path and then uses the appropriate APIs to open the file and ingest its contents. In order to support the use case of reading from a file and then exiting when there are no more events (`ERROR_NO_MORE_ITEMS`) I added a config option to change the behavior of the reader from waiting for more events to stopping.
   
   I also had to add `shutdown_timeout` option to make Winlogbeat wait for events to finish publishing before exiting.
   
   To keep it simple, globs are not supported. This would have required the introduction of a "prospector" to continuously monitor the glob for new / moved / deleted files.
   
       winlogbeat.event_logs:
         - name: ${EVTX_FILE}
           no_more_events: stop
   
       winlogbeat.shutdown_timeout: 30s
       winlogbeat.registry_file: evtx-registry.yml
   
       output.elasticsearch.hosts: ['http://localhost:9200']
   
   Closes elastic#4450

   

   andrewkroh committed Apr 8, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for 511f781
   • Browse repository at this point

   Copy the full SHA

   511f781 View commit details

   Browse the repository at this point in the history

2. Add reference docs

   

   andrewkroh committed Apr 8, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for e194a26
   • Browse repository at this point

   Copy the full SHA

   e194a26 View commit details

   Browse the repository at this point in the history

3. Set log.file.path when reading from file

   

   andrewkroh committed Apr 8, 2019
   Configuration menu

   • View commit details
   • Copy full SHA for e2fb70d
   • Browse repository at this point

   Copy the full SHA

   e2fb70d View commit details

   Browse the repository at this point in the history