Simple way to get wmi data from remote machines into ELK .... very extensible

elk_process_submission.ps1

$LOGSTASH_IP = "192.168.197.222"
$Computers = Get-Content "C:\hosts.txt"

foreach ($computer in $Computers)
{
	Get-WmiObject Win32_Process -Computername $computer `
		| Select Caption,CreationDate,Description,ExecutablePath,Name,ProcessId,ParentProcessId `
		| ConvertTo-Json -Compress `
		| % { Invoke-WebRequest -Headers @{"Content-Type"="application/json"} -Method "POST" -Uri "http://$($LOGSTASH_IP):8080" -Body $_ }
}


<#
# below is a simple logstash config which would work #
input {
	http {}
}

output {
    elasticsearch {
        hosts => '192.168.197.222:9200'
        index => 'process_logs'
    }
}
#>