ELK通过winlogbeat收集windows系统日志并转发给logstash配置文件

1、windows主机上winlogbeat配置# Winlogbeat inputs winlogbeat.event_logs: # 1. 应用程序日志 - name: Application ignore_older: 72h # 2. 系统日志 - name: System ignore_older: 72h # 3. 安全日志 - name: Security ignore_older: 72h # 【重要建议】安全日志量极大建议只采集关键事件ID否则容易撑爆存储 # event_id: 4624, 4625, 4634, 4647, 4672, 4688, 4689, 4720, 4726 # Processors processors: - add_host_metadata: ~ - add_cloud_metadata: ~ # Outputs # 禁用 Elasticsearch 输出 # output.elasticsearch: # hosts: [localhost:9200] # 启用 Logstash 输出 output.logstash: hosts: [10.10.xxx.xx:5044] # 使用你之前提供的 Logstash 地址 compression_level: 3 loadbalance: true bulk_max_size: 2048 # Logging logging.level: info logging.to_files: true logging.files: path: C:\ProgramData\winlogbeat\logs name: winlogbeat.log keepfiles: 72、logstash配置文件放入新建的pipeline目录里 [rootelk-lo-node03 pipeline]# cat windows-winlogbeat-log.conf input { beats { port 5045 #目录下多个conf文件的话端口要修改不要冲突 tags [windows-input] } } output { elasticsearch { hosts [https://10.10.xxx.xx:9200] index logs-app-windows-%{yyyy.MM.dd} user elastic password JcJv*xxxxxxxxxxxx ssl_certificate_verification false } stdout { codec rubydebug } }3、pipeline目录下新增conf文件后要同步修改pipelines.yml[rootelk-lo-node03 config]# pwd /opt/logstash/config [rootelk-lo-node03 config]# ll total 48 -rw-r--r-- 1 root root 2924 Apr 1 17:49 jvm.options -rw-r--r-- 1 root root 8680 Apr 1 17:49 log4j2.properties -rw-r--r-- 1 root root 502 Jun 4 14:37 logstash.conf -rw-r--r-- 1 root root 342 Apr 1 17:49 logstash-sample.conf -rw-r--r-- 1 root root 15745 Apr 1 17:49 logstash.yml drwxr-xr-x 2 root root 98 Jun 16 15:12 pipeline -rw-r--r-- 1 root root 794 Jun 16 15:14 pipelines.yml -rw-r--r-- 1 root root 1696 Apr 1 17:49 startup.options [rootelk-lo-node03 config]# ll pipeline total 12 -rw-r--r-- 1 root root 750 Jun 4 16:01 beats-elk-log.conf -rw-r--r-- 1 root root 359 Jun 16 15:03 network-device-log.conf -rw-r--r-- 1 root root 360 Jun 16 09:53 windows-winlogbeat-log.conf [rootelk-lo-node03 config]# cat pipelines.yml - pipeline.id: beats-elk-log #接收filebeat日志 path.config: config/pipeline/beats-elk-log.conf pipeline.workers: 2 pipeline.batch.size: 125 pipeline.batch.delay: 50 queue.type: persisted queue.max_bytes: 1gb queue.checkpoint.acks: 1024 queue.drain: false - pipeline.id: windows-winlogbeat-log #接收winlogbeat日志 path.config: config/pipeline/windows-winlogbeat-log.conf pipeline.workers: 2 pipeline.batch.size: 125 pipeline.batch.delay: 50 queue.type: persisted queue.max_bytes: 1gb queue.checkpoint.acks: 1024 queue.drain: false - pipeline.id: network-device-log #接收防火墙等网络设备日志 path.config: config/pipeline/network-device-log.conf pipeline.workers: 2 pipeline.batch.size: 125 pipeline.batch.delay: 50 queue.type: persisted queue.max_bytes: 1gb queue.checkpoint.acks: 1024 queue.drain: false