Custom Windows event log package

The custom Windows event log package allows you to ingest events from any Windows event log channel. You can get a list of available event log channels by running Get-WinEvent -ListLog * | Format-List -Property LogName in PowerShell on Windows Vista or newer. If Get-WinEvent is not available, Get-EventLog * may be used. Custom ingest pipelines may be added by setting one up in Ingest Node Pipelines (use the global search field to search for "ingest pipelines").

Use the Custom Windows event logs integration when you need to collect events from Windows event log channels that are not covered by the prebuilt integrations. This integration provides flexibility, but does not include specialized ingest pipelines—the data is collected in its raw form.

Before using this integration, check if one of these alternatives better fits your use case:

• System integration: Collects from the Application, System, and Security channels with specialized ingest pipelines that enrich the data for observability dashboards and alerting.
• Windows integration: Collects from PowerShell, Sysmon, Windows Defender, AppLocker, and ForwardedEvents channels with security-focused ingest pipelines.

Using the System or Windows integrations for their supported channels provides better out-of-the-box value because their ingest pipelines parse and enrich the event data, making it more useful for dashboards, searches, and security detections.

If you specify more than 22 query conditions (event IDs or event ID ranges), some versions of Windows will prevent the integration from reading the event log due to limits in the query system. If this occurs, a similar warning as shown below:

The specified query is invalid.

In some cases, the limit may be lower than 22 conditions. For instance, using a mixture of ranges and single event IDs, along with an additional parameter such as ignore older, results in a limit of 21 conditions.

If you have more than 22 conditions, you can work around this Windows limitation by using a drop_event processor to do the filtering after filebeat has received the events from Windows. The filter shown below is equivalent to event_id: 903, 1024, 2000-2004, 4624 but can be expanded beyond 22 event IDs.

- drop_event.when.not.or:
  - equals.winlog.event_id: "903"
  - equals.winlog.event_id: "1024"
  - equals.winlog.event_id: "4624"
  - range:
      winlog.event_id.gte: 2000
      winlog.event_id.lte: 2004

In addition to the fields specified below, this integration includes the ECS Dynamic Template. Any field that follow the ECS Schema will get assigned the correct index field mapping and does not need to be added manually.