syslog-ng Premium Edition 7.0.19 - Administration Guide

windowsevent: Collecting Windows event logs

Event log messages collected by the Windows Event Collector for syslog-ng PE use this special source. To collect Windows event log messages, include this source in one of your source statements.

The Windows Event Collector tool for syslog-ng PE collects the log messages of Windows-based hosts in Unix datagram sockets, and then forwards them to a syslog-ng PE server over HTTPS (using TLS encryption and mutual authentication). syslog-ng PE reads the log messages using the windowsevent() source, and then parses the logs into key-value paris using the XML parser.

The XML parser uses the list-handling functionality to handle lists in the XML. Note that you cannot disable the list-handling functionality for the windowsevent() source.

For more information, see Windows Event Collector Administration Guide.

Declaration

source s_wec {
    windowsevent(
      prefix(".windowsevent.")
      unix-domain-socket("`syslog-ng-root`/var/run/wec.sock")
    );
};

Starting with version 7.0.13, the syslog-ng PEwindowsevent() source can process XML arrays and make the elements of the arrays available as name-value pairs. For example, the following XML array becomes available as name-value pairs:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <EventID>5059</EventID>
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">WIN-K1678A68SQ6$</Data>
  </EventData>

From the previous example, the following name-value pairs become available: ${Event.System.EventID} (5059), ${Event.EventData.SubjectUserSid} (S-1-5-18), ${Event.EventData.SubjectUserName} (WIN-K1678A68SQ6$).

windowsevent() source options

The windowsevent() driver has the following options:

prefix()

Description: The prefix that you wish to append to the key-value pairs.

If you want to send Windows event logs to SDATA, then set prefix(".SDATA."). This can be useful, for example, when you forward Windows event logs to a syslog-ng Store Box.

unix-domain-socket()

Description: The path to the Unix domain socket to read messages from.

Sending and storing log messages — destinations and destination drivers

A destination is where a log message is sent if the filtering rules match. Similarly to sources, destinations consist of one or more drivers, each defining where and how messages are sent.

To define a destination, add a destination statement to the syslog-ng configuration file using the following syntax.

destination <identifier> {
    destination-driver(params);
    destination-driver(params);
    ...
};

destination d_demo_tcp {
    network("10.1.2.3" port(1999));
};

destination d_tcp {
    network("target_host" port(1999));
};

The following table lists the destination drivers available in syslog-ng PE.

elasticsearch2: Sending messages directly to Elasticsearch version 2.0 or higher (DEPRECATED)

Starting with version 5.6 of syslog-ng PE can directly send log messages to Elasticsearch, allowing you to search and analyze your data in real time, and visualize it with Kibana.

Note the following limitations when using the syslog-ng PE elasticsearch2 destination:

• This destination is only supported on the Linux platforms that use the linux glibc2.11 installer, including: Red Hat ES 7, Ubuntu 14.04 (Trusty Tahr).

• Since syslog-ng PE uses Java libraries, the elasticsearch2 destination has significant memory usage.

• The log messages of the underlying client libraries are available in the internal() source of syslog-ng PE.

@module mod-java
@include "scl.conf"

elasticsearch2(
    index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
    type("test")
    cluster("syslog-ng")
);

@module mod-java
@include "scl.conf"

destination d_elastic {
    elasticsearch2(
        index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
        type("test")
    );
};

@module mod-java
@include "scl.conf"

options {
    threaded(yes);
    use-uniqid(yes);
};

source s_syslog {
    syslog();
};

destination d_elastic {
    elasticsearch2(
        index("syslog-ng_${YEAR}.${MONTH}.${DAY}")
        type("test")
        cluster("syslog-ng")
        client-mode("transport")
        custom-id("${UNIQID}")
        flush-limit("10000")
    );
};

log {
    source(s_syslog);
    destination(d_elastic);
    flags(flow-control);
};

@include "scl.conf"

source s_network {
    network(port(5555));
};

destination d_elastic {
    elasticsearch2(
        client-mode("http")
        cluster("es-syslog-ng")
        index("x201")
        cluster-url("http://192.168.33.10:9200")
        type("slng_test_type")
        flush-limit("0")
    );
};

log {
    source(s_network);
    destination(d_elastic);
    flags(flow-control);
};

• To install the software required for the elasticsearch2 destination, see Prerequisites.

• For details on how the elasticsearch2 destination works, see How syslog-ng PE interacts with Elasticsearch.

• For the list of options, see Elasticsearch2 destination options (DEPRECATED).