The winlog input plugin allows you to read Windows Event Log.
The plugin supports the following configuration parameters:
Key | Description | Default |
Channels | A comma-separated list of channels to read from. | ​ |
Interval_Sec | Set the polling interval for each channel. (optional) | 1 |
DB | Set the path to save the read offsets. (optional) | ​ |
Note that if you do not set db, the plugin will read channels from the beginning on each startup.
Here is a minimum configuration example.
[INPUT]Name winlogChannels Setup,Windows PowerShellInterval_Sec 1DB winlog.sqlite​[OUTPUT]Name stdoutMatch *
Note that some Windows Event Log channels (like Security
) requires an admin privilege for reading. In this case, you need to run fluent-bit as an administrator.
If you want to do a quick test, you can run this plugin from the command line.
$ fluent-bit -i winlog -p 'channels=Setup' -o stdout