syslog-ng Premium Edition 7.0.9 - Administration Guide

windowsevent: Collecting Windows event logs

Event log messages collected by the Windows Event Collector for syslog-ng PE use this special source. To collect Windows event log messages, include this source in one of your source statements.

The Windows Event Collector tool for syslog-ng PE collects the log messages of Windows-based hosts in Unix datagram sockets, and then forwards them to a syslog-ng PE server over HTTPS (using TLS encryption and mutual authentication). syslog-ng PE reads the log messages using the windowsevent() source, and then parses the logs into key-value paris using the XML parser.

For more information, see Windows Event Collector Administration Guide.

Declaration:

source s_wec {
    windowsevent(
      prefix(".windowsevent.")
      unix-domain-socket("`syslog-ng-root`/var/run/wec.sock")
    );
};

windowsevent() source options

The windowsevent() driver has the following options:

prefix()

Description: The prefix that you wish to append to the key-value pairs.

If you want to send Windows event logs to SDATA, then set prefix(".SDATA."). This can be useful, for example, when you forward Windows event logs to a syslog-ng Store Box.

unix-domain-socket()

Description: The path to the Unix domain socket to read messages from.

Sending and storing log messages — destinations and destination drivers

A destination is where a log message is sent if the filtering rules match. Similarly to sources, destinations consist of one or more drivers, each defining where and how messages are sent.

To define a destination, add a destination statement to the syslog-ng configuration file using the following syntax.

destination <identifier> {
    destination-driver(params);
    destination-driver(params);
    ...
};

destination d_demo_tcp {
    network("10.1.2.3" port(1999));
};

destination d_tcp {
    network("target_host" port(1999));
};

The following table lists the destination drivers available in syslog-ng PE.

elasticsearch: Sending messages directly to Elasticsearch version 1.x

Starting with version 5.6 of syslog-ng PE can directly send log messages to Elasticsearch, allowing you to search and analyze your data in real time, and visualize it with Kibana.

Note the following limitations when using the syslog-ng PE elasticsearch destination:

• This destination is only supported on the Linux platforms that use the linux glibc2.11 installer, including: Debian 7 (wheezy), Red Hat ES 7, Ubuntu 12.04 (Precise Pangolin), Ubuntu 14.04 (Trusty Tahr).

• Since syslog-ng PE uses the official Java Elasticsearch libraries, the elasticsearch destination has significant memory usage.

• The log messages of the underlying client libraries are available in the internal() source of syslog-ng PE.

@module mod-java
@include "scl.conf"

elasticsearch(
    index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
    type("test")
    cluster("syslog-ng")
);

@module mod-java
@include "scl.conf"

destination d_elastic {
    elasticsearch(
        index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
        type("test")
    );
};

@module mod-java
@include "scl.conf"

options {
    threaded(yes);
    use-uniqid(yes);
};

source s_syslog {
    syslog();
};

destination d_elastic {
    elasticsearch(
        index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
        type("test")
        cluster("syslog-ng")
        client-mode("transport")
        custom-id("${UNIQID}")
        flush-limit("10000")
    );
};

log {
    source(s_syslog);
    destination(d_elastic);
    flags(flow-control);
};

• To install the software required for the elasticsearch destination, see Prerequisites.

• For details on how the elasticsearch destination works, see How syslog-ng PE interacts with Elasticsearch.

• For the list of options, see Elasticsearch destination options.