· 6 years ago · Jan 27, 2020, 10:42 PM
1###################### Winlogbeat Configuration Example ########################
2
3# This file is an example configuration file highlighting only the most common
4# options. The winlogbeat.reference.yml file from the same directory contains
5# all the supported options with more comments. You can use it as a reference.
6#
7# You can find the full configuration reference here:
8# https://www.elastic.co/guide/en/beats/winlogbeat/index.html
9
10#======================= Winlogbeat specific options ===========================
11
12# event_logs specifies a list of event logs to monitor as well as any
13# accompanying options. The YAML data type of event_logs is a list of
14# dictionaries.
15#
16# The supported keys are name (required), tags, fields, fields_under_root,
17# forwarded, ignore_older, level, event_id, provider, and include_xml. Please
18# visit the documentation for the complete details of each option.
19# https://go.es.io/WinlogbeatConfig
20winlogbeat.event_logs:
21 - name: Application
22 ignore_older: 72h
23
24 - name: System
25
26 - name: Security
27 processors:
28 - script:
29 lang: javascript
30 id: security
31 file: ${path.home}/module/security/config/winlogbeat-security.js
32
33 - name: Microsoft-Windows-Sysmon/Operational
34 processors:
35 - script:
36 lang: javascript
37 id: sysmon
38 file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js
39
40#==================== Elasticsearch template settings ==========================
41
42setup.template.settings:
43 index.number_of_shards: 1
44 #index.codec: best_compression
45 #_source.enabled: false
46
47
48#================================ General =====================================
49
50# The name of the shipper that publishes the network data. It can be used to group
51# all the transactions sent by a single shipper in the web interface.
52#name:
53
54# The tags of the shipper are included in their own field with each
55# transaction published.
56#tags: ["service-X", "web-tier"]
57
58# Optional fields that you can specify to add additional information to the
59# output.
60#fields:
61# env: staging
62
63
64#============================== Dashboards =====================================
65# These settings control loading the sample dashboards to the Kibana index. Loading
66# the dashboards is disabled by default and can be enabled either by setting the
67# options here or by using the `setup` command.
68#setup.dashboards.enabled: false
69
70# The URL from where to download the dashboards archive. By default this URL
71# has a value which is computed based on the Beat name and version. For released
72# versions, this URL points to the dashboard archive on the artifacts.elastic.co
73# website.
74#setup.dashboards.url:
75
76#============================== Kibana =====================================
77
78# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
79# This requires a Kibana endpoint configuration.
80setup.kibana:
81
82 # Kibana Host
83 # Scheme and port can be left out and will be set to the default (http and 5601)
84 # In case you specify and additional path, the scheme is required: http://localhost:5601/path
85 # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
86 #host: "localhost:5601"
87
88 # Kibana Space ID
89 # ID of the Kibana Space into which the dashboards should be loaded. By default,
90 # the Default Space will be used.
91 #space.id:
92
93#============================= Elastic Cloud ==================================
94
95# These settings simplify using Winlogbeat with the Elastic Cloud (https://cloud.elastic.co/).
96
97# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
98# `setup.kibana.host` options.
99# You can find the `cloud.id` in the Elastic Cloud web UI.
100#cloud.id:
101
102# The cloud.auth setting overwrites the `output.elasticsearch.username` and
103# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
104#cloud.auth:
105
106#================================ Outputs =====================================
107
108# Configure what output to use when sending the data collected by the beat.
109
110#-------------------------- Elasticsearch output ------------------------------
111#output.elasticsearch:
112 # Array of hosts to connect to.
113 #hosts: ["localhost:9200"]
114
115 # Optional protocol and basic auth credentials.
116 #protocol: "https"
117 #username: "elastic"
118 #password: "changeme"
119
120#----------------------------- Logstash output --------------------------------
121output.logstash:
122 # The Logstash hosts
123 hosts: ["192.168.0.114:5044"]
124
125 # Optional SSL. By default is off.
126 # List of root certificates for HTTPS server verifications
127 #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
128
129 # Certificate for SSL client authentication
130 #ssl.certificate: "/etc/pki/client/cert.pem"
131
132 # Client Certificate Key
133 #ssl.key: "/etc/pki/client/cert.key"
134
135#================================ Processors =====================================
136
137# Configure processors to enhance or manipulate events generated by the beat.
138
139processors:
140 - add_host_metadata: ~
141 - add_cloud_metadata: ~
142 - add_docker_metadata: ~
143
144#================================ Logging =====================================
145
146# Sets log level. The default log level is info.
147# Available log levels are: error, warning, info, debug
148#logging.level: debug
149
150# At debug level, you can selectively enable logging only for some components.
151# To enable all selectors use ["*"]. Examples of other selectors are "beat",
152# "publish", "service".
153#logging.selectors: ["*"]
154
155#============================== X-Pack Monitoring ===============================
156# winlogbeat can export internal metrics to a central Elasticsearch monitoring
157# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
158# reporting is disabled by default.
159
160# Set to true to enable the monitoring reporter.
161#monitoring.enabled: false
162
163# Sets the UUID of the Elasticsearch cluster under which monitoring data for this
164# Winlogbeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
165# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
166#monitoring.cluster_uuid:
167
168# Uncomment to send the metrics to Elasticsearch. Most settings from the
169# Elasticsearch output are accepted here as well.
170# Note that the settings should point to your Elasticsearch *monitoring* cluster.
171# Any setting that is not set is automatically inherited from the Elasticsearch
172# output configuration, so if you have the Elasticsearch output configured such
173# that it is pointing to your Elasticsearch monitoring cluster, you can simply
174# uncomment the following line.
175#monitoring.elasticsearch:
176
177#================================= Migration ==================================
178
179# This allows to enable 6.7 migration aliases
180#migration.6_to_7.enabled: true