Winlogbeat configuration - need help

Graylog Central (peer support)
,
1

Hello :slight_smile:
I hope someone could help me :wink:

I want to collect ALL events of level Critical, Error and Warning + from level Information JUST events id 1074, 6005, 6006, 6008. (Due to monitoring restart/shutdown of servers).
How to configure it? :thinking:
I tried this, but it did not work :

  • name: System
    ignore_older: 10h
    level: critical, error, warning
    level: information
    event_id: 1074, 6005, 6006, 6008

I received only Information events id 1074, 6005, 6006, 6008 but NO events of Critical, Error and Warning level :frowning:

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.