Windows Event Log

The winlog input plugin allows you to read Windows Event Log.

Content:

" class="reference-link">Configuration Parameters

The plugin supports the following configuration parameters:

Key Description Default
Channels A comma-separated list of channels to read from.
Interval_Sec Set the polling interval for each channel. (optional) 1
DB Set the path to save the read offsets. (optional)

Note that if you do not set db, the plugin will read channels from the beginning on each startup.

" class="reference-link">Configuration Examples

Configuration File

Here is a minimum configuration example.

  1. [INPUT]
  2. Name winlog
  3. Channels Setup,Windows PowerShell
  4. Interval_Sec 1
  5. DB winlog.sqlite
  6. [OUTPUT]
  7. Name stdout
  8. Match *

Note that some Windows Event Log channels (like Security) requires an admin privilege for reading. In this case, you need to run fluent-bit as an administrator.

Command Line

If you want to do a quick test, you can run this plugin from the command line.

  1. $ fluent-bit -i winlog -p 'channels=Setup' -o stdout