Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for rendering ForwardedEvents in Winlogbeat. #1891

Merged
merged 1 commit into from
Jun 21, 2016

Conversation

andrewkroh
Copy link
Member

When reading events from the ForwardedEvents log, Winlogbeat was always attempting to render the event locally event using messages files on the collector. This was wrong because the collector may not have the same message files as the source machine. It would result in a message_error if the collector machine was missing the application that originally logged the event on the source machine.

This PR changes Winlogbeat to not attempt to render the event on the collector machine, but instead use the event as is. This requires that the subscription for the Windows event collector uses the "RenderedText" format which includes the message string and any description strings with the forwarded event.

Fixes: #1031 (comment)

@ruflin
Copy link
Member

ruflin commented Jun 20, 2016

LGTM. I think this config should be added to the config file? Also worth a CHANGELOG entry.

@andrewkroh andrewkroh force-pushed the feature/render-forwarded-events branch from 630b271 to b65565f Compare June 20, 2016 14:37
@andrewkroh
Copy link
Member Author

Added a changelog entry.

@andrewkroh
Copy link
Member Author

Added forwarded config option to the config files.

When reading events from the ForwardedEvents log, Winlogbeat was always attempting to render the event locally event using messages files on the collector. This was wrong because the collector may not have the same message files as the source machine. It would result in a message_error if the collector machine was missing the application that originally logged the event on the source machine.

This PR changes Winlogbeat to not attempt to render the event on the collector machine, but instead use the event as is. This requires that the subscription for the Windows event collector uses the "RenderedText" format which includes the message string and any description strings with the forwarded event.
@andrewkroh andrewkroh force-pushed the feature/render-forwarded-events branch from d75df9e to 5c30594 Compare June 20, 2016 20:42
@ruflin ruflin merged commit 4b8cbf0 into elastic:master Jun 21, 2016
@@ -25,8 +25,8 @@
# dictionaries.
#
# The supported keys are name (required), tags, fields, fields_under_root,
# ignore_older, level, event_id, provider, and include_xml. Please visit the
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh We should probably add the full config details to the winlogbeat.full.yml config file.

@andrewkroh andrewkroh deleted the feature/render-forwarded-events branch July 15, 2016 13:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants