Sending Windows Event Logs to Grafana Loki Server

[hack3rcon]

Hello,
What is the problem with this configuration?

[SERVICE]
    flush        1
    log_level    info
    daemon       off

[INPUT]
    Name         winlog
    Channels     Security
    Interval_Sec 1
    DB           winlog.db
    # Filter specific Event IDs
    WHITELIST    4660,4663,4656,4659

[OUTPUT]
    Name         loki
    Match        *
    Host         192.168.1.2
    Port         3100
    Labels       job=fluent-bit, host=${HOSTNAME}
    Auto_Kubernetes_Labels off
    Line_Format  json

Why is the Grafana Loki server not receiving any data?

Thank you.

[patrick-stephens]

Probably because it is not getting any input for some reason.

I would use log_level debug to check for any errors or other issues being reported - what does the log actually say?

I would also use the stdout output to see what data is being received.

https://chronosphere.io/learn/fluent-bit-tips-tricks/

[hack3rcon]

Hello,
Thank you so much for your reply.
Can you make the necessary changes to my configuration file?

[patrick-stephens]

I've included all the info for you to do that already. Change the log_level in your config to debug then follow the guidance in my blog to use stdout or look at the docs: https://docs.fluentbit.io/manual/pipeline/outputs/standard-output

[hack3rcon]

Hi,
Thanks again.
I changed the configuration file as follows:

[SERVICE]
    flush        1
    log_level    debug
    daemon       off

[INPUT]
    Name         winlog
    Channels     Security
    Interval_Sec 1
    DB           winlog.db

[FILTER]
    Name         grep
    Match        *
    Regex        EventID 4660|4663|4656|4659

[OUTPUT]
    Name         stdout
    Match        *
    Format       json

I received the following output:

Fluent Bit v3.2.7
* Copyright (C) 2015-2025 The Fluent Bit Authors
* Fluent Bit is a CNCF sub-project under the umbrella of Fluentd
* https://fluentbit.io

______ _                  _    ______ _ _           _____  _____
|  ___| |                | |   | ___ (_) |         |____ |/ __  \
| |_  | |_   _  ___ _ __ | |_  | |_/ /_| |_  __   __   / /`' / /'
|  _| | | | | |/ _ \ '_ \| __| | ___ \ | __| \ \ / /   \ \  / /
| |   | | |_| |  __/ | | | |_  | |_/ / | |_   \ V /.___/ /./ /___
\_|   |_|\__,_|\___|_| |_|\__| \____/|_|\__|   \_/ \____(_)_____/


[2025/03/07 22:26:54] [ info] Configuration:
[2025/03/07 22:26:54] [ info]  flush time     | 1.000000 seconds
[2025/03/07 22:26:54] [ info]  grace          | 5 seconds
[2025/03/07 22:26:54] [ info]  daemon         | 0
[2025/03/07 22:26:54] [ info] ___________
[2025/03/07 22:26:54] [ info]  inputs:
[2025/03/07 22:26:54] [ info]      winlog
[2025/03/07 22:26:54] [ info] ___________
[2025/03/07 22:26:54] [ info]  filters:
[2025/03/07 22:26:54] [ info]      grep.0
[2025/03/07 22:26:54] [ info] ___________
[2025/03/07 22:26:54] [ info]  outputs:
[2025/03/07 22:26:54] [ info]      stdout.0
[2025/03/07 22:26:54] [ info] ___________
[2025/03/07 22:26:54] [ info]  collectors:
[2025/03/07 22:26:54] [ info] [fluent bit] version=3.2.7, commit=ccd3586226, pid=7452
[2025/03/07 22:26:54] [debug] [engine] coroutine stack size: 98302 bytes (96.0K)
[2025/03/07 22:26:54] [ info] [storage] ver=1.5.2, type=memory, sync=normal, checksum=off, max_chunks_up=128
[2025/03/07 22:26:54] [ info] [simd    ] disabled
[2025/03/07 22:26:54] [ info] [cmetrics] version=0.9.9
[2025/03/07 22:26:54] [ info] [ctraces ] version=0.6.0
[2025/03/07 22:26:54] [ info] [input:winlog:winlog.0] initializing
[2025/03/07 22:26:54] [ info] [input:winlog:winlog.0] storage_strategy='memory' (memory only)
[2025/03/07 22:26:54] [debug] [winlog:winlog.0] created event channels: read=824 write=828
[2025/03/07 22:26:54] [debug] [input:winlog:winlog.0] load channel<Security record=149048 time=1741159902>
[2025/03/07 22:26:54] [debug] [stdout:stdout.0] created event channels: read=852 write=856
[2025/03/07 22:26:54] [ info] [sp] stream processor started
[2025/03/07 22:26:54] [ info] [output:stdout:stdout.0] worker #0 started
[2025/03/07 22:26:55] [debug] [input:winlog:winlog.0] read 10348 bytes from 'Security'
[2025/03/07 22:26:55] [debug] [input:winlog:winlog.0] save channel<Security record=149300 time=1741414615>

But on the Loki server side I still don't receive any data:

# tcpdump -vvv -i any src 192.168.1.3 and port 3100
tcpdump: data link type LINUX_SLL2
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes

What is your opinion?

[patrick-stephens]

Should you be getting any input?
You're only subscribing to a single channel and then excluding all events except the specific ones.

I think also that grep needs a string to work with.

I would remove the grep filter and see what it shows?