Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Winlogbeat Development

Winlogbeat Development

Start a Windows VM

vagrant up win2012

Login Options

You can connect to the VM in multiple ways.

  • Microsoft Remote Desktop (available in Mac App Store)
  • SSH
  • VirtualBox Console

Remote Desktop

Connect to with vagrant/vagrant.


vagrant ssh-config win2012 > ssh-config
echo '  HostKeyAlgorithms +ssh-dss' >> ssh-config
ssh -F ssh-config win2012


Open VirtualBox, Click Show on VM


On the host machine (not Windows) update the generated files.

make update

There are two types of tests -- Go unit tests and Python unit tests. Neither require any external services like Elasticsearch.

cd $Env:GOPATH/src/ 

Unit Test

go test -v ./...

Python Unit Tests

go test -c
nosetests.exe -v tests\system

Building winlogbeat.exe

go build

Running Winlogbeat

Clear registry file.

To make tests repeatable you will want to delete the state persisted by Winlogbeat.

rm .\data\.winlogbeat.yml

Output Events to JSON File

.\winlogbeat.exe -c winlogbeat.yml -e -d eventlog -E output.elasticsearch.enabled=false -E output.file.path=output -E output.file.filename=events.json

Output to Elasticsearch

If you have Elasticsearch running on the VirtualBox host machine you can access it at

.\winlogbeat.exe -c winlogbeat.yml -e -d eventlog -E "output.elasticsearch.hosts=[]"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment