class LogStash::Inputs::EventLog
This input will pull events from a msdn.microsoft.com/en-us/library/windows/desktop/bb309026%28v=vs.85%29.aspx[Windows Event Log]. Note that Windows Event Logs are stored on disk in a binary format and are only accessible from the Win32 API. This means Losgtash needs to be running as an agent on Windows servers where you wish to collect logs from, and will not be accesible across the network.
To collect Events from the System Event Log, use a config like:
- source,ruby
-
input {
eventlog { type => 'Win32-EventLog' logfile => 'System' }
}
Public Instance Methods
register()
click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 42 def register # wrap specified logfiles in suitable OR statements @hostname = Socket.gethostname @logger.info("Opening eventlog #{@logfile}") begin @eventlog = Win32::EventLog.open(@logfile) rescue SystemCallError => e if e.errno == 1314 # ERROR_PRIVILEGE_NOT_HELD @logger.fatal("No privilege held to open logfile", :logfile => @logfile) end raise end @converter = LogStash::Util::Charset.new(Encoding.find(@charset)) end
run(queue)
click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 60 def run(queue) @logger.debug("Tailing Windows Event Log '#{@logfile}'") old_total = @eventlog.total_records() flags = Win32::EventLog::FORWARDS_READ | Win32::EventLog::SEEK_READ rec_num = @eventlog.read_last_event.record_number while !stop? new_total = @eventlog.total_records() if new_total != old_total rec_num = @eventlog.oldest_record_number() if @eventlog.full? @eventlog.read(flags, rec_num).each { |log| e = process(log); decorate(e); queue << e } old_total = new_total rec_num = @eventlog.read_last_event.record_number + 1 end Stud.stoppable_sleep(@interval/1000.0) { stop? } end end
Private Instance Methods
convert(field)
click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 108 def convert(field) if field.is_a?(String) @converter.convert(field) elsif field.is_a?(Array) field.map { |v| @converter.convert(v) } else field end end
process(log)
click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 81 def process(log) attrs = { "host" => @hostname, "Logfile" => @logfile, "message" => log["description"].strip, "Category" => log["category"], "ComputerName" => log["computer"], "EventIdentifier" => log["event_id"], "EventType" => log["event_type"], "RecordNumber" => log["record_number"], "SourceName" => log["source"], "TimeGenerated" => log["time_generated"], "TimeWritten" => log["time_written"], "Type" => log["event_type"], "User" => log["user"], "InsertionStrings" => log["string_inserts"] } attrs.each do |k,v| next if ["host", "Logfile"].include?(k) attrs[k] = convert(v) end LogStash::Event.new(attrs) end