Стандартный конфигурационный файл Winlogbeat

Для ОС Windows:

processors:
- add_host_metadata:
    netinfo.enabled: true

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
  - name: Security
    ignore_older: 72h
  - name: System
    ignore_older: 72h
  - name: Microsoft-Windows-Sysmon/Operational
    ignore_older: 72h
  - name: Microsoft-Windows-Windows Defender/Operational
    ignore_older: 72h
  - name: Microsoft-Windows-PowerShell/Operational
    event_id: 4104
    ignore_older: 72h
  - name: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    ignore_older: 72h
  - name: Kaspersky Event Log
    ignore_older: 72h
  - name: Kaspersky Endpoint Security
    ignore_older: 72h
  - name: Kaspersky Security for Exchange Servers
    ignore_older: 72h
  - name: Microsoft-Windows-TaskScheduler/Operational
    ignore_older: 72h

output.logstash:
  ssl.enabled: true
  ssl.verification_mode: none