Hi,
Today, I use the sidecar with Winlogbeat to collect Windows logs and use a GELF format to obtain a parsed logs in Graylog GELF input (Not use extractor or pipeline for this, except to remove the winlogbeat prefix).
For others logs types, I use Rsyslog to collect and forward to two differents outputs:
Is it possible to send raw logs from winlogbeat or from graylog output to store raw logs to a third party server ?
Thanks