Provide a way of shipping eventlog from file

[kunisen]

For all general issues, please provide the following details for fast resolution:

• Version: Logstash 5.6

• Operating System: Linux

• Config
  e.g. path => "/data/event_log/xxx.evtx"

• Sample Data:
  Any .evtx file.

• Description
  We have logstash-input-eventlog to pull the event log from windows by using @eventlog = Win32::EventLog.open(@logfile).

https://github.com/logstash-plugins/logstash-input-eventlog/blob/master/lib/logstash/inputs/eventlog.rb#L49

Is there a way to ship event log file from a directory specified path?
Or could we implement this feature in the future?

[jsvd]

Can you clarify a bit more what is the architecture you're looking for?
You want to grab event log data into evtx files on windows, ship them to linux and process them on linux?
Have you tried using winlogbeat on windows?

[kunisen]

Thanks, Joao! @jsvd

Yes, the goal is to collect the .evtx log (generated by customized application but could be opened by Windows event log viewer)
The path is like "C:\data\event_log\xxx.evtx".
To collect it (no matter windows / linux) from the specified path, and ship it to elasticsearch.

Logstash is not essential. Winlogbeat is also good to be a resolution if it is possible.

Something more, sorry I didn't test the behavior of winlogbeat.
But from the below description, it looks like even use winlogbeat, we could still only specify the logs that could be retrieved from "Get-EventLog *" powershell cmdlet.

So it might be difficult for the user to specify the path directly.
(The user might need to import the .evtx file to his Windows OS at first, and use the powershell cmdlet to get event log name.)

https://www.elastic.co/guide/en/beats/winlogbeat/master/configuration-winlogbeat-options.html#configuration-winlogbeat-options-event_logs-name

[RealLinkers]

Having the same issue. None of Beats agent's can process evt/evtx files.

[kunisen]

sorry for the direct ping.
do we have any updates here 😄 @jsvd

[jsvd]

Any updates will be visible here, there's no one who is very familiar with this environment/technology to implement reading from files without considerable amount of effort/time.
On the winlogbeat side, the desire for the feature is mentioned in elastic/beats#465 (comment), but there hasn't been much demand, hence the low priority.

I'm more than happy to review someone's attempt at adding this feature here.