通过Winlogbeat连接windows日志文件到ES

# 目录

[TOC]

> 轻量型 Windows  事件日志采集器 用于密切监控基于 Windows 的基础设施上发生的事件。使用 Winlogbeat，将 Windows 事件日志流式传输至  Elasticsearch 和 Logstash。输送至 Elasticsearch 或 Logstash。在 Kibana 中实现可视化。

使用Winlogbeat前，确保电脑上安装了Elasticsearch和Kibana

------

# 一、下载并安装Winlogbeat

[下载地址](https://www.elastic.co/cn/downloads/beats/winlogbeat)

将下载下来的压缩包解压到`C:\Program Files`并且将文件夹名称重命名为`Winlogbeat`

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592983920951.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/图片1592983920951.png)

Winlogbeat目录

# 二、配置Winlogbeat

找到软件根目录下的配置文件，文件名为`winlogbeat.yml`

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592984372948.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/图片1592984372948.png)

ES服务器的配置

![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592984458845-20220815155032903.png)

Kibana服务器

# 三、运行Winlogbeat

3.1、以管理员身份打开 PowerShell 提示符。如果是 Windows XP，需要安装 PowerShell。

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592983968297.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/图片1592983968297.png)

打开PowerShell

3.2、打开之后需要进入软件目录

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592984151680.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/图片1592984151680.png)

进入目录

3.3、这里需要将Winlogbeat安装为Windows服务，出现了一点问题

![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592984852546-20220815155009161.png)

安装为Windows服务出现问题

可以先修改powershell的脚本执行权限`set-ExecutionPolicy RemoteSigned`再进行执行脚本

具体参考：https://blog.csdn.net/XreqcxoKiss/article/details/104482823

[![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871593336190275.png)](https://saas.bk-cdn.com/8fbde4a1-8dda-41b8-a3f7-53fe266fba50/图片1593336190275.png)

成功

3.4、setup 命令设置初始环境，包括索引模板，ILM策略和写入别名以及Kibana仪表板（如果可用）。如果仪表板已设置，请省略。

![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592984553879-20220815154915160.png)

设置基本环境

3.5运行Winlogbeat

![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592985021470-20220815154928999.png)

运行Winlogbeat

![img](https://raw.githubusercontent.com/ctccaozhe/f_jpg/master/uPic/%E5%9B%BE%E7%89%871592985099262-20220815152820645.png)

查看接受状态

更多操作请见：  [winlogbeat官网手册](https://www.elastic.co/guide/en/beats/winlogbeat/7.8/index.html)  [winlogbeat入门指南](https://www.elastic.co/guide/en/beats/winlogbeat/7.8/winlogbeat-getting-started.html)