azure Winevent logs

Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) 41

I want get the windows event logs data from Azure VM's to ELK stack. Please let me know the procedure ?

https://www.elastic.co/guide/en/observability/7.17/monitor-azure.html

from the article is there any documentation to get the windows event logs to ELK?

AnuragSingh-MSFT 21,361 Reputation points

2022-09-14T06:44:06.017+00:00

@Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) , can you please clarify the question?

Are you trying to get the logs already collected and stored in "Log Analytics to Elastic Observability?
If yes, you can export data from Log Analytics Workspace. Please see this link for more details. As these methods easily integrate with LogicApps, Azure Data Factory, it is possible to send the output to a target system - provided the target has a way to ingest these. For example, when using logic apps, the exported data could be saved to blob storage

The following article does have some ways through which it could be integrated with LogicApps or similar solution to ingest already stored data.
Seven ways to ingest data into Elasticsearch!

I would suggest reaching out to Elastic to get further help.

If your question was related to something else, please clarify with example/screenshot (as appropriate).
Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) 41 Reputation points

2022-09-14T08:40:24.873+00:00

Thanks for your response.

Windows event logs are configured in the Agent configuration menu in the log analytics workspace. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events
Please refer that link to check event log configuration.

Once Windows event logs are configured. Windows Event log information are available in the EVENT table under the logs menu. to check the event information i will run the event query in the query window. So i want to get that information into ELK stack.

Now i want to know how to get that windows event log information into ELK stack (kibana)? please share any reference document or guidance.

PFA.

1 answer

AnuragSingh-MSFT 21,361 Reputation points

2022-09-15T06:11:24.79+00:00

Hi @Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) ,

Thank you for the clarifications provided above. Based on the requirement, all logs to be sent to Log Analytics workspace's Event (or any other table) could also be forwarded to another destination using Log Analytics workspace data export. To enable this, please follow the steps below:

1. Create an Event Hub resource. Event hubs are used to stream data/logs/events. In current case, the Event data from VM would come to Log Analytics Workspace --> and also be streamed from Log Analytics Workspace through EventHubs. The ELK stack would consume the event data from event hubs.

2. On the Log Analytics Workspace, click on Data Export under Settings

3. Click on "+New export rule" --> Provide name and ensure that "Enable upon creation" is selected --> Select the tables of interest (Event) --> Next --> Select the Event Hub created in step 1 --> Next --> Create

4. Use Azure Event Hubs Plugin for consuming the incoming events for use with Logstash with ELK. For help regarding this step, please see Getting Help section of the official Elastic doc here - Getting Help | Azure Event Hubs Plugin

Please let me know if you have any questions.

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.
Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) 41 Reputation points

2022-09-15T10:15:03.233+00:00

Hi, Thank you for your detailed explanation. Can you please share the any sample output screen or any other reference documentation or article? It would be helpful to proceed further.

AnuragSingh-MSFT 21,361 Reputation points

2022-09-16T03:49:12.393+00:00

@Bhuvaneswari Maddi (iCORE-CIS - iCORE-CIS) , thank you for the reply. Please see the following article for detailed steps of configuring ELK with Event hub (Step 4 in the answer above).
ELK Stack Setup in Azure to Fetch Data From EventHub.
The other steps are available in the corresponding links provided in the answer above.

Hope this helps!

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

azure Winevent logs

1 answer

Your answer