winlogbeat

A module to install and manage the winlogbeat log shipper

Vox Pupuli

puppet

8,174 downloads

131 latest version

5.0 quality score

Version information

  • 1.0.1 (latest)
  • 1.0.0
  • 0.2.2
  • 0.2.1
  • 0.2.0
released Mar 5th 2021
This version is compatible with:
  • Puppet Enterprise 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x, 2018.1.x
  • Puppet >= 5.5.8 < 7.0.0
  • Windows

Start using this module

Documentation

puppet/winlogbeat — version 1.0.1 Mar 5th 2021

puppet-winlogbeat

Table of Contents

  1. Description
  2. Setup - The basics of getting started with winlogbeat
  3. Usage - Configuration options and additional functionality
  4. Reference - An under-the-hood peek at what the module is doing and how
  5. Limitations - OS compatibility, etc.
  6. Development - Guide for contributing to the module

Description

The winlogbeat module installs and configures the winlogbeat log shipper maintained by elastic.

Setup

What winlogbeat affects

By default winlogbeat downloads the software to your system, and installs winlogbeat along with required configurations.

Setup Requirements

The winlogbeat module depends on:

Beginning with winlogbeat

winlogbeat can be installed with puppet module install puppet-winlogbeat (or with r10k, librarian-puppet, etc.)

The only required parameter, other than which event logs to ship, is the outputs parameter.

Usage

All of the default values in winlogbeat follow the upstream defaults (at the time of writing).

To ship files to elasticsearch:

class { 'winlogbeat':
  outputs => {
    'elasticsearch' => {
     'hosts' => [
       'http://localhost:9200',
       'http://anotherserver:9200'
     ],
     'index'       => 'winlogbeat',
     'cas'         => [
        '/etc/pki/root/ca.pem',
     ],
    },
  },
}

To ship log files through logstash:

class { 'winlogbeat':
  outputs => {
    'logstash'     => {
     'hosts' => [
       'localhost:5044',
       'anotherserver:5044'
     ],
     'index'       => 'winlogbeat',
     'loadbalance' => true,
    },
  },
}

Shipper and logging options can be configured the same way, and are documented on the elastic website.

Limitations

This module doesn't load the elasticsearch index template into elasticsearch (required when shipping directly to elasticsearch).

Development

Pull requests and bug reports are welcome. If you're sending a pull request, please consider writing tests if applicable.

Release Notes/Contributors/Etc.

Used the pcfens/filebeat module as a starting point.