Windows Servers

Observe supports ingesting log data from Windows servers, event logs and application logs on the filesystem are both supported. Fluentd is the recommended forwarder.

Install Fluentd on the Windows system

Install the fluentd forwarder.

Update the fluentd configuration file (C:/opt/td-agent/etc/td-agent/td-agent.conf) to add the following sources:

####
## Source descriptions:
##
##
##  Filesystem logs
##
<source>
  @type tail
  @id input_tail
  tag fslog.#{Socket.gethostname}
  path C:/logs/observe.log
  pos_file /var/log/td-agent/tmp/observe.log.pos
  path_key tailed_path
  <parse>
    @type regexp
    expression /^(?<message>.*)$/
  </parse>
</source>
##
##  Windows event logs
##
<source>
  @type windows_eventlog
  @id windows_eventlog
  tag winevent.#{Socket.gethostname}
  channels application,system,security
  <storage>
    @type local
    persistent true
    path /var/log/td-agent/tmp/winevt.pos
  </storage>
</source>