Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 15 additions & 18 deletions pipeline/inputs/windows-event-log.md
Original file line number Diff line number Diff line change
@@ -1,23 +1,23 @@
# Windows Event Log

The **winlog** input plugin allows you to read Windows Event Log.
The _Windows Event Log_ (`winlog`) input plugin lets you read the Windows Event Log.

## Configuration Parameters <a href="config" id="config"></a>
## Configuration parameters

The plugin supports the following configuration parameters:

| Key | Description | Default |
| ------------ | ----------------------------------------------------- | ------- |
| Channels | A comma-separated list of channels to read from. | |
| Interval_Sec | Set the polling interval for each channel. (optional) | 1 |
| DB | Set the path to save the read offsets. (optional) | |
| Threaded | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` |
| `Channels` | A comma-separated list of channels to read from. | _none_ |
| `Interval_Sec` | Set the polling interval for each channel. (optional) | `1` |
| `DB` | Set the path to save the read offsets. (optional) | _none_ |
| `Threaded` | Indicates whether to run this input in its own [thread](../../administration/multithreading.md#inputs). | `false` |

Note that if you do not set _db_, the plugin will read channels from the beginning on each startup.
If `db` isn't set, the plugin will read channels from the beginning on each startup.

## Configuration Examples <a href="config_example" id="config_example"></a>
## Configuration examples

### Configuration File
### Configuration file

Here is a minimum configuration example.

Expand Down Expand Up @@ -52,15 +52,12 @@ pipeline:
Match *
```

{% endtab %}
{% endtabs %}

Note that some Windows Event Log channels (like `Security`) requires an admin privilege for reading. In this case, you need to run fluent-bit as an administrator.
Some Windows Event Log channels, like `Security`, require administrative privileges for reading. In this case, you need to run Fluent Bit as an administrator.

### Command Line
### Command line

If you want to do a quick test, you can run this plugin from the command line.
If you want to do a test, you can run this plugin from the command line:

```shell
$ ./fluent-bit -i winlog -p 'channels=Setup' -o stdout
```
```bash
fluent-bit -i winlog -p 'channels=Setup' -o stdout
```