winlogbeat收集windows系统日志

1、安装winlogbeat

这里 下载winlogbeat 压缩
解压到 C:\Program Files
重新命名文件夹为winlogbeat
用管理员身份打开windows的 powershell
运行以下命令来安装服务

PS C:\Users\Administrator> cd 'C:\Program Files\Winlogbeat'
PS C:\Program Files\Winlogbeat> .\install-service-winlogbeat.ps1

如果在系统上禁用了脚本执行，则需要为当前会话设置执行策略以允许脚本运行。 PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-winlogbeat.ps1.

或者可以使用以下命令来关闭一些安全防护，输入命令后按Y确认

PS C:\Program Files\Winlogbeat> set-executionpolicy remotesigned
PS C:\Program Files\Winlogbeat> set-executionpolicy Bypass

2、配置

本文测试使用winlogbeat收集日志，发送到elasticsearch 
修改配置文件 ：winlogbeat.yml 
填写要输出到es的地址

output.elasticsearch:
  hosts:
    - es:9200

修改客户机名字

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
name: PC_name

使用以下命令检查配置文件的正确性

 PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e

3、启动winlogbeat

使用以下命令启动winlogbeat服务，如果你的es是有验证的，请参考这里做配置

PS C:\Program Files\Winlogbeat> Start-Service winlogbeat

4、在ES查看日志

[root@master ~]# curl '192.168.14.5:9200/_cat/indices?v'
health status index                       uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .kibana                     kSyxiC6-RdmJmp8StSdbYg   1   1          8            0    102.6kb         51.3kb
green  open   winlogbeat-6.0.0-2019.07.15 _yL7v2lPTuKEOyrmKlRIPQ   3   1     231954            0    204.6mb        102.3mb
green  open   switch-2019.07.15           VkAGSk7iSoatF7Akjmsi2Q   5   1       8182            0        5mb          2.5mb
green  open   winlogbeat-6.0.0-2019.07.05 HddvOs0XSayT07yPssGycQ   3   1          6            0    145.5kb         72.7kb
green  open   winlogbeat-6.0.0-2019.07.13 A8xbl1fKQC-1ZOwFnQIeGA   3   1     174247            0    155.2mb         77.5mb
green  open   winlogbeat-6.0.0-2019.06.23 tY6Qg326QFqMXe56oj2doQ   3   1        754            0      1.3mb        694.5kb

5、维护

Windows Service维护

;启动服务

net start winlogbeat

;停止服务

net stop winlogbeat

;卸载服务

powershell "C:\Program Files\winlogbeat\uninstall-service-winlogbeat.ps1"