Skip to content

Instantly share code, notes, and snippets.

@stonith
Created July 24, 2012 23:32
Show Gist options
  • Save stonith/3173376 to your computer and use it in GitHub Desktop.
Save stonith/3173376 to your computer and use it in GitHub Desktop.
logstash config to accept iis/wineventlogs and send to elasticsearch
input {
tcp {
type => "iis"
port => 5141
format => json
#Disable timeouts as logstash may drop events when timing out
data_timeout => -1
}
tcp {
type => "winevent"
port => 5140
format => json
#Disable timeouts as logstash may drop events when timing out
data_timeout => -1
}
}
filter {
date {
type => "iis"
# Try to pull the timestamp from the 'timestamp' field (parsed above with
# grok). The IIS time format looks like: "2012-06-07 15:58:09"
EventTime => "yyyy-MM-dd HH:mm:ss"
}
date {
type => "winevent"
# Try to pull the timestamp from the 'timestamp' field (parsed above with
# grok). The Windows Event Log time format looks like: "2012-06-07 15:58:09"
EventTime => "yyyy-MM-dd HH:mm:ss"
}
}
output {
# stdout {
# debug => true
# }
elasticsearch {
# Setting 'embedded' will run a real elasticsearch server inside logstash.
# This option below saves you from having to run a separate process just
# for ElasticSearch, so you can get started quicker!
host => "localhost"
port => "9300"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment