AFAIK Windows doesn’t natively send syslog. If you need something to ship event viewer logs, you’ll need something like Winlogbeat or NXlog. Both of those will ship via the lumberjack protocol (i.e., Beats). I’ll note that Graylog, on its own, collects nothing. There must always be an external application (e.g., syslog, some sort of beats agent, nxlog, etc.) shipping logs to Graylog for those logs to show up in Graylog.
1 Like