secabstraction

# Pass your collection script and parameters, it will do the rest
Invoke-PowerStash -Scriptblock ${function:Get-CimEvents} `
                  -Parameters @{CimSession=$Sessions;LogName='Security';EventId=4624}

secabstraction

$JSON = @' 
{
    "template": "powerstash-*",
    "mappings": {
        "eventlogentry": {
            "properties" : {
                "Id": { "type": "string" },
                "TimeCreated" : { "type" : "date" },
                "DateCreated" : { "type" : "date" },
                "EventId" : { "type" : "integer" },

secabstraction

$Parameters = @{
    CimSession = $CimSession
    ClassName = 'Win32_NTLogEvent'
    Filter = $Filter
    ErrorAction = 'Continue'
    ErrorVariable = 'Errors'
}

Get-CimInstance @Parameters | foreach {
    

secabstraction

# First lets collect some objects
$Logons = Get-CimInstance -ClassName Win32_NtLogEvent -Filter "LogFile='Security' AND EventCode='4624'"

# Now for the export
$Logons | Export-Elastic -Node http://myelastic:9200

secabstraction

begin { $JsonStrings = [Collections.Generic.List[String]]::new() }
    
process { 
    foreach ($Object in $InputObject) { 
        
        $IndexProperties = @{
            index = @{
                _index = $Index
                _type = $Type
                _id = $Id

secabstraction

# Create a connection pool
$Pool = New-ConnectionPool -Nodes @('http://test1:9200','http://test2:9200') -Sniffing

# Create a connection configuration from the pool
$Config = New-ConnectionConfiguration -Pool $Pool

# Tweak the configuration
$Config.SetBasicAuthentication('username','password')
$Config.SetProxy('http://myproxy:8080','username','password')

secabstraction

# Create a simple client via Elastic's Uri
$Client = New-ElasticClient -Node http://myelastic:9200

# Test connection
$Client.CatHealth()

# Stash
$Client.BulkAsync($AllTheThings)

secabstraction

function Get-CimEvents {
    [CmdLetBinding(DefaultParameterSetName = 'Filter')]
    param (
        [Parameter(Mandatory = $true)]
        [Alias('Session')]
        [Microsoft.Management.Infrastructure.CimSession[]]
        $CimSession,

        [Parameter(ParameterSetName = 'Filter')]
        [ValidateNotNullOrEmpty()]

secabstraction

{
    "template": "logstash-*",
    "settings" : {
        "index.number_of_shards" : 3,
        "index.number_of_replicas" : 1,
        "index.query.default_field" : "@message",
        "index.routing.allocation.total_shards_per_node" : 2,
        "index.auto_expand_replicas": false
    },
    "mappings": {

secabstraction

##################################################################
# /etc/elasticsearch/elasticsearch.yml
#
# Base configuration for a write heavy cluster
#

# Cluster / Node Basics
cluster.name: logng

# Node can have abritrary attributes we can use for routing