Collecting logs from Windows PC/Servers

Bek

Hello everyone!

Please tell me, how do you think it is more correct to install the Winlogbeat agent on Windows computers, or is it possible to collect Windows logs through the Windows Event Collector service? Also, what is the most correct way to send logs from Windows Event Collector to Energy Logserver? 😀

SzymonC

Hi,

If Customer is already using WEF (Windows Event Forwarding) service and has some polices for it, then it's not bad idea to go for it. If it's completely new technology for Customer, then I'd go with standard agents installation.
Energy Logserver has dedicated linux software for collecting data through WEF, it's called Energy Collector.
https://eventcollector.com

Bek

SzymonC
Hi

I am having problems using the Winlogbeat agent to collect logs from Windows Event Collector (WEC). I tried to apply the following configuration:

**winlogbeat.event_logs:

name: WEC-System
paths:
- C:\Windows\System32\winevt\Logs\WEC-System.evtx**

However, an error occurs when applying this configuration and starting the Winlogbeat service.

Can you please tell me how to set up winlogbeat correctly to collect logs from WEC?