Telegraf: Windows Event Log Analytics

[cruscio]

Feature Request

With the recent introduction of syslog parsing and increased attention in the Log Analytics space, it would be nice to compliment the syslog Telegraf input with a corresponding log input plugin for Windows. See also - https://community.influxdata.com/t/consuming-windows-event-log/5635

Proposal:

Telegraf Input plugin similar to the syslog input plugin, designed to feed from Windows Event Log (much like Elastic's WinLogBeat )

Current behavior:

n/a

Desired behavior:

Abstract log handling in Influx, with with support for native sources from both Windows and Linux inputs. Specifically, an Event Log telegraf input to complement the syslog input.

Use case: [Why is this important (helps with prioritizing requests)]

My use case: I work for a software vendor looking to use Influx as a telemetry analytics component of an application monitoring platform to be deployed alongside our software installs. The application monitoring platform currently uses ElasticSearch & Beats for log analytics, but with the growth of Elastic metrics handling and Influx's log handling, we're considering unifying both needs on a single platform. It would be a huge reduction in effort for us to reduce our endpoint footprint from telegraf + 3 beats agents down to a single telegraf agent; and our server footprint from two database clusters (Influx and Elastic) to one InfluxDB cluster

More generally, Influx is a cross-platform solution, but there doesn't seem to be much love for the windows side in the new logging functionality. For those of us stuck monitoring endpoints in Windows land, it'd be nice to see the ecosystem continue to provide cross-platform feature parity.

[endersonmaia]

Just adding some information, maybe a way to go is via Windows Event Collector

[candlerb]

Another possible approach is to use nxlog to convert Windows logs to syslog. There is an example from fluentd.

According to Splunk documentation, fetching Windows logs remotely using WMI requires machines to be joined to a domain.

[natejgardner]

wevutil is also a handy way to access Windows event logs. And of course Get-WinEvent in Powershell can be used similarly to the way Get-Counter works, if extracting data from the CLI is any easier than using the .NET libraries for this. E.g.: Get-WinEvent System; Get-WinEvent "PDW Component Failures"; etc. Can be filtered using -FilterHashTable for performance. For convenience if you run through the Format-List pipe everything is in object format.

Would really love to be able to capture arbitrary logs and providers. Very excited for this feature!

[sumptersmartt]

This feature would be fantastic. With Microsoft monitoring agent, azure log analytics and grafana, I can do some really cool stuff. It'd be fantastic if I could do the same with telegraf/influxdb. It'd be a big lift even if I could just get an ID/timestamp.

[berndsattler]

Logging windows event log entries into influx would be perfect for us too. We are build up a supervising systems for production machine. The PLC of the machines are writing all errors in windows evet log so it would be great to get this directly into InfluxDB

[dmoronta]

Hi all, some news from this topic?
Regards

[dilshaat]

This Feature is much desired for us as well.
Thanks

[R-Studio]

+1

[MarkusK77]

+1 must have

thx

[Naseko]

+1
It would be great to have such a feature.

[PWSys]

+1

[iiidddaaannn102]

[phone]

[anuar45]

Hi, I have made draft plugin, it works, but it is based on winlogbeat and increases size of binary by ~30MB. I need some time to squeeze it.

[anuar45]

Ok, this +30MB binary size was just a result of not using build flags -s -w

[FramnkRulez]

Any update on this one? Eagerly awaiting news :)

[anuar45]

I am going to rewrite it soon

[StefanSa]

@anuar45
that would be very helpful, one more reason away from elastic and towards influxdb.

[anuar45]

PR #7020 updated with fully revised version, @danielnelson could you please review it?

[ssoroka]

merged in #8000