Combining Processor functions for Winlogbeat

Graylog Central (peer support)
,
1

Hi all,

Total noob here with Elastic, so hopefully you can help.
I’m running a Graylog server which uses elastic backend, and have winlogbeat installed on all PCs via the Graylog Collector Sidecar.

My current config is:

winlogbeat.event_logs:
  - name: Security
    level: critical, error, warning

This works fine.

I’m looking to be able to also capture SOME informational event IDs, such as account logons/logoffs.
In order to do this, I want to effectively say:

winlogbeat.event_logs:
  - name: Security
    level: critical, error, warning

AND Event ID’s 4264, 4634 etc etc etc

Is this possible?

Thanks,

Matt Dobson

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.