Windows Servers

Observe supports ingesting log data from Windows servers, including event logs and application logs on the filesystem. OBserve recommends Fluentd as the forwarder.

Install Fluentd on the Windows system

Install the fluentd forwarder.

Update the fluentd configuration file (C:/opt/td-agent/etc/td-agent/td-agent.conf) to add the following sources:

####
## Source descriptions:
##
##
##  Filesystem logs
##
<source>
  @type tail
  @id input_tail
  tag fslog.#{Socket.gethostname}
  path C:/logs/observe.log
  pos_file /var/log/td-agent/tmp/observe.log.pos
  path_key tailed_path
  <parse>
    @type regexp
    expression /^(?<message>.*)$/
  </parse>
</source>
##
##  Windows event logs
##
<source>
  @type windows_eventlog
  @id windows_eventlog
  tag winevent.#{Socket.gethostname}
  channels application,system,security
  <storage>
    @type local
    persistent true
    path /var/log/td-agent/tmp/winevt.pos
  </storage>
</source>