More Windows Event logs than what I need

Graylog Central (peer support)
,
1

Hey all,

we had requests to start gathering windows event logs for graylog and would appreciate if anyone could put me in the right track since as of now we hadnt bothered with windows logs yet.

I want to get only a certain types of logs. Event ID 4624 for example. the input logon event in the collector config is: [{‘name’:‘Security’, ‘event_ID’:‘4624’}]

The problem is that this gets all sorts of event ID’s, all Security, but way more than just the 4624 ID that I want.

I could drop those messages with a pipeline rule easily enough but I’d rather learn if there is a way to control that through the collector config. Otherwise if I were to need three or four different IDs that happen to be on different areas of the event names, I dont end up pulling ALL the events into graylog

Thanks,
Stephen

2

You can configure Winlogbeat to only forward a specific set of Windows Events:

3

Thanks, I’ll take a look at those :slight_smile:

4

Thanks @jochen

So the answer is to use the snippets for a more granular configuration :smiley:

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.