README
¶
Winlogbeat
You know, for windows event logs
Winlogbeat is an open-source log collector that ships Windows Event Logs to Elasticsearch or Logstash. It installs as a Windows service on all versions since Windows XP.
Contributions
We love contributions from our community! Please read the CONTRIBUTING.md file.
Documentation
¶
Overview ¶
Package winlogbeat contains the entrypoint to Winlogbeat which is a lightweight data shipper for Windows event logs. It ships events directly to Elasticsearch or Logstash. The data can then be visualized in Kibana.
Downloads: https://www.elastic.co/downloads/beats/winlogbeat
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package beater provides the implementation of the libbeat Beater interface for Winlogbeat.
|
Package beater provides the implementation of the libbeat Beater interface for Winlogbeat. |
|
Package checkpoint persists event log state information to disk so that event log monitoring can resume from the last read event in the case of a restart or unexpected interruption.
|
Package checkpoint persists event log state information to disk so that event log monitoring can resume from the last read event in the case of a restart or unexpected interruption. |
|
Package config provides the winlogbeat specific configuration options.
|
Package config provides the winlogbeat specific configuration options. |
|
Package eventlog provides the means for reading event logs from Windows.
|
Package eventlog provides the means for reading event logs from Windows. |
|
Package sys provides common data structures and utilties functions that are used by the subpackages for interfacing with the system level APIs to collect event log records from Windows.
|
Package sys provides common data structures and utilties functions that are used by the subpackages for interfacing with the system level APIs to collect event log records from Windows. |
|
eventlogging
Package eventlogging provides access to the Event Logging API that was designed for applications that run on the Windows Server 2003, Windows XP, or Windows 2000 operating system.
|
Package eventlogging provides access to the Event Logging API that was designed for applications that run on the Windows Server 2003, Windows XP, or Windows 2000 operating system. |
|
wineventlog
Package wineventlog provides access to the Windows Event Log API used in all versions of Windows since Vista (i.e.
|
Package wineventlog provides access to the Windows Event Log API used in all versions of Windows since Vista (i.e. |
Click to show internal directories.
Click to hide internal directories.