Integration error - force flag required

[kspringer-maf]

I'm attempting to add 'Custom Windows Event Logs' integration to our existing 'endpoints-initial' policies so we can have the Elastic Agent gather WEC logs from a WEC Server, but when I click Save it gives me this error.

'Datastreams matching "logs-winlog.winlog-*" already exist and are not managed by this package, force flag is required'

Are we not allowed to add integrations into the default agent?

[kspringer-maf]

I figured it out. I just needed to change the Dataset name to something other than what was auto-populated.

[redla1N]

Dear @kspringer-maf.

Have you received Windows updates to your SO?
I've been trying to set this up for the third day and it's not working. The agent has identified it, it is listed as Heatlhy, but there is no event.
I've set up Wazuh before, everything worked fine, but it doesn't work with SO.
Can you describe step by step what needs to be done to receive messages, please?

[kspringer-maf]

1. Open 'Elastic Fleet' from SO sidebar.

2. Open 'Fleet' from Elastic sidebar.

3. Click 'Agent policies' from the top menu.

4. Click 'endpoints-initial' policy

5. Click 'Add Integration' button at top right

6. Find and choose the 'Custom Windows Event Logs' integration.

7. Click 'Add Custom Windows Event Logs' blue button from top right

Set the following settings:
Integration Name: wec
Description: Forwarded Logs
Channel Name: Your Folder/Your Subfolder (this assumes you have events flowing here)
Dataset Name: winlog.wec (NOTE: no dashes or underscores allowed)
Tags: wec
Agent policies: endpoints-initial

8. Click 'Save and continue'

9. Click 'Save and deploy changes'

10. You should now be able to Hunt for the logs in SO Hunt tool.
    * AND event.dataset: "winlog.wec"

[redla1N]

Thanks for your answer! I do how u say. But im dont have events. Look at

but im dont have events. Look at

[redla1N]

@kspringer-maf can u help me please?

[kspringer-maf]

@redla1N I am just a user who advises where I can. I don't know anything about your infrastructure, your tech knowledge, or your understanding of the functions of Security Onion. You should start a new post with your specific info and questions.

[redla1N]

@kspringer-maf im opened. if u know, can u ask in my top pls.
#14727