Winlogbeat

Winlogbeat is an open source log shipper that can forward Windows event logs to Humio.

Installation

The instructions below are taken in part from the official Winlogbeat documentation, here. You might also look at their General Guide and their Getting Started Guide.

Download the latest version of Winlogbeat.

Important Note: You must download and install the open source version of Winlogbeat. The proper download page will look like the screenshot below. The standard version of Winlogbeat is designed to only work with Elasticsearch and will not connect to Humio successfully. Please make sure that the file name of the file that you download looks like winlogbeat-oss-7.2.0-windows-x86_64.zip.)

Extract the contents of the .zip file into C:\Program Files\Winlogbeat.

Open a PowerShell prompt as an Administrator.

Navigate to the Winlogbeat directory PS C:\Users\Administrator>cd 'c:\Program Files\Winlogbeat'

Run the Winlogbeat installation script PS C:\Program Files\Winlogbeat> .\install-service-winlogbeat.ps1. If script execution is disabled on the system you will need to enable it for the current session using the following command: powershell.exe -executionpolicy unrestricted -file .\install-service-winlogbeat.ps1).

Edit the winlogbeat.yml file found in C:\Program Files\Winlogbeat to contain the basic settings needed to send data to Humio. The following example file collects application, system, and security data and also logs Winlogbeat’s operations to disk in order to facilitate troubleshooting if needed. Update the hosts and password fields with your Humio server’s address and the ingest token for your repository.

winlogbeat.event_logs:
  - name: Application
  - name: System
  - name: Security

output.elasticsearch:
  hosts: ["http://$YOUR_HUMIO_URL/api/v1/ingest/elastic-bulk"]
  password: "*************************************"

logging.to_files: true
logging.files:
  path: C:\ProgramData\Winlogbeat\Logs
logging.level: info

See WinLogBeat Documentation for more infromation on configuration.

Verify that your winlogbeat.yml file is valid using the following command in PowerShell: PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e

If your configuration is valid you can start Winlogbeat using the following command: PS C:\Program Files\Winlogbeat> Start-Service winlogbeat. In the future you can start and stop the Winlogbeat service using the Windows Services Control Panel as shown below.

Configuration

The following section covers additional areas for configuration of Winlogbeat including how to add additional event logs to be sent to Humio and how to make performance adjustments. For more information about Winlogbeat configuration, please read the [Winlogbeat Configuration Options Guide](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html.

Adding Event Logs

In the example configuration above we set up Winlogbeat to send events from the Windows System, Security, and Application event logs

winlogbeat.event_logs:
  - name: Application
  - name: System
  - name: Security

A full list of available event logs can be seen in PowerShell by running the following — the results follow:

Get-WinEvent -ListLog * | Format-List -Property LogName

LogName : Application
LogName : HardwareEvents
LogName : Internet Explorer
LogName : Key Management Service
LogName : Security
LogName : System
LogName : Windows PowerShell
LogName : ForwardedEvents
LogName : Microsoft-AppV-Client/Admin
...
LogName : Windows Networking Vpn Plugin Platform/OperationalVerbose

If you want to add PowerShell events to Humio you would add the following line to the winlogbeat.event_logs section of your winlogbeat.yml file and then restart the Winlogbeat service:

  - name: Windows PowerShell

Tuning Performance

You can tune Winlogbeat’s performance by setting the compression_level, worker, and bulk_max_size values in the output.elasticsearch section of your winlogbeat.yml based on the volume of data that you are shipping to Humio. Below is an example output.elasticsearch section

output.elasticsearch:
  hosts: ["http://$YOUR_HUMIO_URL/api/v1/ingest/elastic-bulk"]
  password: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  compression_level: 5
  bulk_max_size: 200
  worker: 1

The default compression_level used by all beats is 3, but it may be set from 0 (i.e., no compression) to 9 (i.e., the maximum compression). Compressing the data decreases the amount of bandwidth required to ship your data, but uses CPU and other server resources.

The worker states the number of writers (threads) that can write events to Humio.

The bulk_max_size is the number of events or log entries to send in a single batch. The bulk_max_size should not exceed 100 to 300 events for use with Humio. While increasing the number increases the throughput of ingest it has a negative impact on search performance of the resulting events in Humio.

Troubleshooting

The number one cause for trouble with Winlogbeat and Humio is installing the wrong version of Winlogbeat (the non-open source version). If you suspect that you have installed the wrong version, you can uninstall Winlogbeat within PowerShell using the following instructions:

Open a PowerShell prompt as an Administrator.

Navigate to the Winlogbeat directory: PS C:\Users\Administrator>cd 'c:\Program Files\Winlogbeat'

Run the Winlogbeat uninstall script: PS C:\Program Files\Winlogbeat> .\uninstall-service-winlogbeat.ps1

Make a backup of your winlogbeat.yml file and then remove the contents of the C:\Program Files\Winlogbeat> folder.

Install the open source version of Winlogbeat using the instructions found above.