WInlogbeat logs not showing up - SO Eval install

[edvrfn]

My setup which is 2 days old, SO running in VMware Workstation, and using a switch to TAP the traffic to another interface. Management pot is NAT. This part is working and I have zeek/network logs in SO.

Web Management IP of SO: 192.168.6.130

On the same host that is running VMware I downloaded winlogbeat from the SO dashboard and created winlogbeat.yml as below, Pasting only the uncommented lines.

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security

  - name: ForwardedEvents
    tags: [forwarded]

  - name: Microsoft-Windows-sysmon/o perational

  - name: Microsoft-Windows-PowerShell/Operational


setup.template.settings:
  index.number_of_shards: 1

setup.kibana:

output.logstash:

  hosts: ["192.168.6.130:5044"]

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~

added whole 192.16.x.x subnet to so-allow

Please enter your selection: b
Enter a single ip address or range to allow (ex: 10.10.10.10 or 10.10.0.0/16): 192.168.0.0/16
Adding 192.168.0.0/16 to the beats_endpoint role. This can take a few seconds...
Already exists

even added 0.0.0.0/0 to it

Wireshark capture shows host trying to initiate connections but getting refused/dropped by SO and causing TCP retransmissions

log in winlogbeat folder
{"log.level":"info","@timestamp":"2023-05-05T08:23:28.939-0700","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":141},"message":"Attempting to reconnect to backoff(async(tcp://192.168.6.130:5044)) with 40 reconnect attempt(s)","service.name":"winlogbeat","ecs.version":"1.6.0"}

running netstat on SO

[admin@sonion ~]$ netstat -plnt
(No info could be read for "-p": geteuid()=1000 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:27760           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:9200            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4433            0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:1234          0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4434            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:9300            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:8086            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:55000           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:3000            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4505            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:8090            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:4506            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:9822            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:3200            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:9696            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:5601            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:57314           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:3142            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:5000            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:5066            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:1514            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:6379            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:1515            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:6380            0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:6381            0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -

Tested with windows firewall disabled, still same issue,
Not sure what i am missing and yes i only started winlogbeat installation after watching the video.
I see there was a similar discussion but no resolution or updates have been posted in 3 weeks.

[dougburks]

In the title of this discussion, you mention that you are running in Eval mode.

From https://docs.securityonion.net/en/2.3/beats.html:
In order to receive logs from Beats, Security Onion must be running Logstash. Evaluation Mode and Import Mode do not run Logstash, so you’ll need Standalone or a full Distributed Deployment.

[edvrfn]

@dougburks Thanks for pointing it, I will reinstall it.