Hello Community, I have an issue in xml decoder, I’m trying to decode sysmon for linuxs logs i’m using filebeat to send the logs from ubuntu server to my graylog everything works great however filebeat is decoding the keys instead of values of the message.
here is what my graylog showing after decoding.
- it’s showing the decoded keys not the values.
here is my filebeat configuration
what am I missing in my filebeat configuration.
ubuntu server 22
anyone who can help please?
I don’t see that Elastic supports collecting XML from sysinternals for linux using filebeat (see link below). I do see that sysmon can output via syslog. Perhaps that would be a better path forward.
OR I also see that nxlog supports collection of sysmon for linus. See last link below.
hey @chris.black-gl thanks for the replay. I did some research and I know nxlog is the best option for collecting sysmon for linux.
Can you help me how to deploy nxlog comunity version on linux because I can’t see any tutorials about it.
I checked also nxlog website there is no guidelines about how to install nxlog on linux.
Try this for getting it installed. Then google collecting sysmon for linux with nxlog and you should find something that will show you how to set the nxlog configuration file.
hey @chris.black-gl thanks for the replies I finally solved my issue.
I used filebreat decode xml wineventlog
for people who may search for future here is the processor I used
@tijaabo, that’s great news. Thank you for coming back to post the solution for other users!
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.