Skip to content

Commit 51fb848

Browse files
committed
Adding YAML examples and standardizing shell usage for Windows Event Log (winevtlog) input plugin, part of issue #1859.
Signed-off-by: Eric D. Schabell <[email protected]>
1 parent 0570bb4 commit 51fb848

File tree

1 file changed

+20
-17
lines changed

1 file changed

+20
-17
lines changed

pipeline/inputs/windows-event-log-winevtlog.md

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,24 @@ Note that if you do not set _db_, the plugin will tail channels on each startup.
3434
Here is a minimum configuration example.
3535

3636
{% tabs %}
37+
{% tab title="fluent-bit.yaml" %}
38+
39+
```yaml
40+
pipeline:
41+
inputs:
42+
- name: winevtlog
43+
channels: Setup,Windows PowerShell
44+
interval_sec: 1
45+
db: winevtlog.sqllite
46+
outputs:
47+
- name: stdout
48+
match: '*'
49+
```
50+
51+
{% endtab %}
3752
{% tab title="fluent-bit.conf" %}
38-
```python
53+
54+
```text
3955
[INPUT]
4056
Name winevtlog
4157
Channels Setup,Windows PowerShell
@@ -46,20 +62,7 @@ Here is a minimum configuration example.
4662
Name stdout
4763
Match *
4864
```
49-
{% endtab %}
5065

51-
{% tab title="fluent-bit.yaml" %}
52-
```yaml
53-
pipeline:
54-
inputs:
55-
- name: winevtlog
56-
channels: Setup,Windows PowerShell
57-
interval_sec: 1
58-
db: winevtlog.sqllite
59-
outputs:
60-
- name: stdout
61-
match: '*'
62-
```
6366
{% endtab %}
6467
{% endtabs %}
6568

@@ -79,9 +82,9 @@ For further details, please refer to [the MSDN doc](https://learn.microsoft.com/
7982

8083
If you want to do a quick test, you can run this plugin from the command line.
8184

82-
```bash
83-
$ fluent-bit -i winevtlog -p 'channels=Setup' -p 'Read_Existing_Events=true' -o stdout
85+
```shell
86+
$ ./fluent-bit -i winevtlog -p 'channels=Setup' -p 'Read_Existing_Events=true' -o stdout
8487
```
8588

8689
Note that `winevtlog` plugin will tail channels on each startup.
87-
If you want to confirm whether this plugin is working or not, you should specify `-p 'Read_Existing_Events=true'` parameter.
90+
If you want to confirm whether this plugin is working or not, you should specify `-p 'Read_Existing_Events=true'` parameter.

0 commit comments

Comments
 (0)