class LogStash::Inputs::EventLog

This input will pull events from a msdn.microsoft.com/en-us/library/windows/desktop/bb309026%28v=vs.85%29.aspx[Windows Event Log]. Note that Windows Event Logs are stored on disk in a binary format and are only accessible from the Win32 API. This means Losgtash needs to be running as an agent on Windows servers where you wish to collect logs from, and will not be accesible across the network.

To collect Events from the System Event Log, use a config like:

source,ruby

input {

eventlog {
  type  => 'Win32-EventLog'
  logfile  => 'System'
}

}

Public Instance Methods

register() click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 42
def register

  # wrap specified logfiles in suitable OR statements
  @hostname = Socket.gethostname
  @logger.info("Opening eventlog #{@logfile}")

  begin
    @eventlog = Win32::EventLog.open(@logfile)
  rescue SystemCallError => e
    if e.errno == 1314 # ERROR_PRIVILEGE_NOT_HELD
      @logger.fatal("No privilege held to open logfile", :logfile => @logfile)
    end
    raise
  end
  @converter = LogStash::Util::Charset.new(Encoding.find(@charset))
end
run(queue) click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 60
def run(queue)

  @logger.debug("Tailing Windows Event Log '#{@logfile}'")

  old_total = @eventlog.total_records()
  flags     = Win32::EventLog::FORWARDS_READ | Win32::EventLog::SEEK_READ
  rec_num   = @eventlog.read_last_event.record_number

  while !stop?
    new_total = @eventlog.total_records()
    if new_total != old_total
      rec_num = @eventlog.oldest_record_number() if @eventlog.full?
      @eventlog.read(flags, rec_num).each { |log| e = process(log); decorate(e); queue << e }
      old_total = new_total
      rec_num   = @eventlog.read_last_event.record_number + 1
    end
    Stud.stoppable_sleep(@interval/1000.0) { stop? }
  end
end

Private Instance Methods

convert(field) click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 108
def convert(field)
  if field.is_a?(String)
    @converter.convert(field)
  elsif field.is_a?(Array)
    field.map { |v| @converter.convert(v) }
  else
    field
  end
end
process(log) click to toggle source
# File lib/logstash/inputs/eventlog.rb, line 81
def process(log)

  attrs = {
    "host"             => @hostname,
    "Logfile"          => @logfile,
    "message"          => log["description"].strip,
    "Category"         => log["category"],
    "ComputerName"     => log["computer"],
    "EventIdentifier"  => log["event_id"],
    "EventType"        => log["event_type"],
    "RecordNumber"     => log["record_number"],
    "SourceName"       => log["source"],
    "TimeGenerated"    => log["time_generated"],
    "TimeWritten"      => log["time_written"],
    "Type"             => log["event_type"],
    "User"             => log["user"],
    "InsertionStrings" => log["string_inserts"]
  }

  attrs.each do |k,v|
    next if ["host", "Logfile"].include?(k)
    attrs[k] = convert(v)
  end

  LogStash::Event.new(attrs)
end