📒
Book of VanLuong
  • 👨‍💻About the Author
  • Cryptography
    • Cryptanalysis
      • RSA & RSA ATTACK
      • DES (Data Encryption Standard)
      • AES (Advanced Encryption Standard)
      • ECC ( Elliptic Curve of Cryptography)
      • Group-based Cryptography
      • Lattice-based Cryptography
      • ChaCha20-Poly1305
      • Hash Function
      • Wargame CTF
  • C2
    • Practical with Havoc Framework
  • Blue Teaming
    • SIEM & SOC
      • SIEM
      • SOC
      • Splunk
    • Cybersecurity Lab & Threat Intelligence
      • Build ELK Lab
        • Configure Elasticsearch and Kibana setup in ubuntu
        • Fluent Bit – Sending Logs to ELK with Fluent Bit
        • Winlogbeat – Collecting and Forwarding Windows Event Logs.
        • Filebeat – Collecting and Forwarding Windows Event Logs.
        • Send Logs from Winlogbeat through Logstash to ELK
        • Audit policy & Winlogbeat
      • Sysmon configuration
    • PowerShell in Incident Response and Threat Hunting
      • PowerShell For Incident Response
      • PowerShell For Threat Hunting
  • Techniques used in malware
    • DLL side loading
    • DLL Unhooking
    • Call stack spoofing
  • Wazuh App Dashboards for Splunk
  • Windows
    • 70 Vital Windows Commands
    • Windows Registry Forensics
  • Guide to Installing Kali Linux, DVWA, and bWAPP
    • Phần 1. CÀI ĐẶT HỆ ĐIỀU HÀNH KALI LINUX
    • Phần 2. CÀI ĐẶT DVWA
    • Phần 3. CÀI ĐẶT BWAPP
  • CTF
    • CTF-writeup-in-KCSC
Powered by GitBook
On this page

Was this helpful?

  1. Blue Teaming
  2. Cybersecurity Lab & Threat Intelligence
  3. Build ELK Lab

Send Logs from Winlogbeat through Logstash to ELK

PreviousFilebeat – Collecting and Forwarding Windows Event Logs.NextAudit policy & Winlogbeat

Last updated 3 months ago

Was this helpful?

Winlogbeat is a lightweight agent that collects Windows Event Logs and forwards them to Logstash or directly to Elasticsearch. When used with Logstash, logs can be processed and enriched before being stored in Elasticsearch and visualized in Kibana.

We have successfully installed Elasticsearch and Kibana on an Ubuntu machine (hostname: VSM).

Now, I Would like to install Logstash on a separate Ubuntu machine (hostname: VSM1).

sudo apt update && sudo apt install logstash -y

Logstash needs a configuration file to tell it where to receive logs from and where to send them. So let's make a new one for Winlogbeat.

sudo nano /etc/logstash/conf.d/winlogbeat.conf

Replace the IP address, username, and password with your own credentials.

Before starting Logstash, let's check if the configuration is correct:

sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t

"Configuration OK", the config is good!

This command will parse the configuration files (including any files in /etc/logstash/conf.d/) and report any errors or warnings.

-t → It parses and validates all the configuration files (found in the directory specified by --path.settings, such as /etc/logstash) to check for syntax errors or misconfigurations, then exits once testing is complete. This is useful because it allows us to ensure the configuration is correct before we start processing events.

Now let's start and enable Logstash.

sudo systemctl start logstash.service
sudo systemctl enable logstash.service
sudo systemctl status logstash.service

Next, we need to configure Logstash to listen for incoming data from Winlogbeat on port 5044.

sudo /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/winlogbeat.conf

When you run this command:

  • Logstash will start and load the configuration from /etc/logstash/conf.d/winlogbeat.conf.

  • It will begin listening for incoming data (from Winlogbeat on port 5044).

  • It will process the data according to the configuration and send it to the specified output ( Elasticsearch).

Let's verify if there are any issues.

sudo journalctl -u logstash --no-pager --lines=50

Now we need to configure Winlogbeat to Send Logs to Logstash.

We need to replace with our Logstash machine's IP and comment Elasticsearch output.

Next let's test the configuration:

.\winlogbeat.exe test config -c .\winlogbeat.yml -e

Next, let's start the service:

Start-Service winlogbeat
Get-service winlogbeat

Before sending logs, let's check the connection to the configured output (Logstash) is established.

.\winlogbeat.exe test output

This command verifies if Winlogbeat can successfully send logs to the configured destination.

Next, we need to run Winlogbeat using the winlogbeat.yml configuration file and shows real-time logs in the console.

.\winlogbeat.exe -c .\winlogbeat.yml -e

  • .\winlogbeat.exe → Runs the Winlogbeat program to collect windows logs.

  • -c .\winlogbeat.yml → Uses the winlogbeat.yml file for configuration (tells Winlogbeat where to send logs, like Logstash).

  • -e → Shows log messages on the screen instead of saving them to a file.

We now need to confirm whether ELK successfully receives logs from Logstash. From Stack Management → Index Management

Let's create an index and review the logs on the Discover page.

Using filering host.hostname : "Windows10"