- Release Notes and Announcements
- User Guide
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Resource Management
- Permission Management
- Log Collection
- Collection Overview
- Collecting Logs in Self-Built Kubernetes Cluster
- Collecting Syslog
- Collection by LogListener
- Collecting Text Log
- Uploading Log over Kafka
- Uploading Logs via Anonymous Write
- Uploading Logs via Logback Appender
- Uploading Logs via Log4j Appender
- Uploading Log via SDK
- Uploading Log via API
- Importing Data
- Tencent Cloud Service Log Access
- Metric Collection
- Log Storage
- Metric Storage
- Search and Analysis (Log Topic)
- Overview of Search and Analysis
- Syntax and Rules
- Statistical Analysis (SQL)
- Quick Analysis
- SQL Syntax
- SQL Functions
- String Function
- Date and Time Functions
- IP Geographic Function
- URL Function
- Mathematical Calculation Functions
- Mathematical Statistical Function
- General Aggregate Function
- Geospatial Function
- Binary String Function
- Estimation Function
- Type Conversion Function
- Logical Function
- Operators
- Bitwise Operation
- Regular Expression Function
- Lambda Function
- Conditional Expressions
- Array Functions
- Interval-Valued Comparison and Periodicity-Valued Comparison Functions
- JSON Functions
- Window Functions
- Sampling Analysis
- Configuring Indexes
- Reindexing
- Multi-Topic Search
- Context Search and Analysis
- Custom Redirect
- Downloading Log
- Search and Analysis (Metric Topic)
- Dashboard
- Data Processing documents
- Data Processing
- Data Processing Overview
- Creating Processing Task
- Viewing Data Processing Details
- Data Processing Functions
- Function Overview
- Key-Value Extraction Functions
- Enrichment Functions
- Flow Control
- Row Processing Functions
- Field Processing Functions
- Value Structuring Functions
- Regular Expression Processing Functions
- Time Value Processing Functions
- String Processing Functions
- Type Conversion Functions
- Logical and Mathematical Functions
- Encoding and Decoding Functions
- IP Parsing Functions
- Processing Cases
- Scheduled SQL Analysis
- SCF
- Data Processing
- Shipping and Consumption
- Monitoring Alarm
- Historical Documentation
- Practical Tutorial
- Developer Guide
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Topic Management APIs
- Log Set Management APIs
- Index APIs
- Topic Partition APIs
- Machine Group APIs
- Collection Configuration APIs
- Log APIs
- Metric APIs
- Alarm Policy APIs
- Data Processing APIs
- Kafka Protocol Consumption APIs
- CKafka Shipping Task APIs
- Kafka Data Subscription APIs
- COS Shipping Task APIs
- SCF Delivery Task APIs
- Scheduled SQL Analysis APIs
- COS Data Import Task APIs
- Data Types
- Error Codes
- FAQs
- CLS Service Level Agreement
- CLS Policy
- Contact Us
- Glossary
- Release Notes and Announcements
- User Guide
- Product Introduction
- Purchase Guide
- Getting Started
- Operation Guide
- Resource Management
- Permission Management
- Log Collection
- Collection Overview
- Collecting Logs in Self-Built Kubernetes Cluster
- Collecting Syslog
- Collection by LogListener
- Collecting Text Log
- Uploading Log over Kafka
- Uploading Logs via Anonymous Write
- Uploading Logs via Logback Appender
- Uploading Logs via Log4j Appender
- Uploading Log via SDK
- Uploading Log via API
- Importing Data
- Tencent Cloud Service Log Access
- Metric Collection
- Log Storage
- Metric Storage
- Search and Analysis (Log Topic)
- Overview of Search and Analysis
- Syntax and Rules
- Statistical Analysis (SQL)
- Quick Analysis
- SQL Syntax
- SQL Functions
- String Function
- Date and Time Functions
- IP Geographic Function
- URL Function
- Mathematical Calculation Functions
- Mathematical Statistical Function
- General Aggregate Function
- Geospatial Function
- Binary String Function
- Estimation Function
- Type Conversion Function
- Logical Function
- Operators
- Bitwise Operation
- Regular Expression Function
- Lambda Function
- Conditional Expressions
- Array Functions
- Interval-Valued Comparison and Periodicity-Valued Comparison Functions
- JSON Functions
- Window Functions
- Sampling Analysis
- Configuring Indexes
- Reindexing
- Multi-Topic Search
- Context Search and Analysis
- Custom Redirect
- Downloading Log
- Search and Analysis (Metric Topic)
- Dashboard
- Data Processing documents
- Data Processing
- Data Processing Overview
- Creating Processing Task
- Viewing Data Processing Details
- Data Processing Functions
- Function Overview
- Key-Value Extraction Functions
- Enrichment Functions
- Flow Control
- Row Processing Functions
- Field Processing Functions
- Value Structuring Functions
- Regular Expression Processing Functions
- Time Value Processing Functions
- String Processing Functions
- Type Conversion Functions
- Logical and Mathematical Functions
- Encoding and Decoding Functions
- IP Parsing Functions
- Processing Cases
- Scheduled SQL Analysis
- SCF
- Data Processing
- Shipping and Consumption
- Monitoring Alarm
- Historical Documentation
- Practical Tutorial
- Developer Guide
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Topic Management APIs
- Log Set Management APIs
- Index APIs
- Topic Partition APIs
- Machine Group APIs
- Collection Configuration APIs
- Log APIs
- Metric APIs
- Alarm Policy APIs
- Data Processing APIs
- Kafka Protocol Consumption APIs
- CKafka Shipping Task APIs
- Kafka Data Subscription APIs
- COS Shipping Task APIs
- SCF Delivery Task APIs
- Scheduled SQL Analysis APIs
- COS Data Import Task APIs
- Data Types
- Error Codes
- FAQs
- CLS Service Level Agreement
- CLS Policy
- Contact Us
- Glossary
Overview
This document describes how to use Winlogbeat or Filebeat to collect and upload Windows logs to CLS.
Prerequisites
You have activated CLS and created relevant resources such as logset and log topic.
You have obtained the
SecretId and SecretKey in the Tencent Cloud console.Directions
Using Winlogbeat to collect and upload Windows event logs to CLS
Installing Winlogbeat
1. Download the target Winlogbeat version at the official website.
This document takes Winlogbeat 7.6.2 as an example, which can be downloaded here.
2. Decompress the downloaded package to the C drive.
We recommend you create a
winlogbeat folder under the Program Files directory for decompression.3. Open PowerShell as the admin and run the following command:
cd C:\\Program Filescd .\\winlogbeat-7.6.2-windows-x86_64.\\install-service-winlogbeat.ps1
During execution, if an error is reported, enter the
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned command and select y. Then, enter the above command again.
4. Run the following command to test whether the environment is normal.
.\\winlogbeat.exe test config -c .\\winlogbeat.yml -e
If
config OK is returned, the environment is normal.5. Run the following command to start the program.
Start-Service winlogbeat
Uploading logs to CLS
In the
winlogbeat.yml file in C:\\Program Files\\Winlogbeat, change output.kafka to the following to send logs to CLS.output.kafka:enabled: truehosts: ["${region}-producer.cls.tencentyun.com:9095"] # TODO: Service address. The public network port is 9096, and the private network port is 9095.topic: "${topicID}" # TODO: Topic IDversion: "0.11.0.2"compression: "${compress}" # Configure the compression method. Valid values: `gzip`, `snappy`, `lz4`.username: "${logsetID}"password: "${SecurityId}#${SecurityKey}"
Parameter | Description |
LinkType | Currently, SASL_PLAINTEXT is supported. |
hosts | |
topic | Log topic ID, such as 76c63473-c496-466b-XXXX-XXXXXXXXXXXX. |
username | Logset ID, such as 0f8e4b82-8adb-47b1-XXXX-XXXXXXXXXXXX. |
password | Password in the format of ${SecurityId}#${SecurityKey}, such as XXXXXXXXXXXXXX#YYYYYYYY. |
Using Filebeat to collect Windows file logs
Installing Filebeat
1. Download the target version here.
2. Upload and decompress the installation package to the root directory of a drive on the Windows server.
3. Edit the
filebeat.yml file.Note:
Use "/" rather than "" in paths.
4. Find the target log path and edit the module configuration file (with mssql as an example below).
# Module: mssql# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.3/filebeat-module-mssql.html- module: mssql# Fileset for native deploymentlog:enabled: true# Set custom paths for the log files. If left empty,# Filebeat will choose the paths depending on your OS.var.paths: ["D:/Program Files/Microsoft SQL Server/MSSQL10_50.MSSQLSERVER/MSSQL/Log/ERROR*"]
5. Open PowerShell as the admin and run the following command:
# Enter the specific Filebeat pathcd c:/filebeat# Run the installation script to install Filebeat.\\install-service-filebeat.ps1# Start the mssql module.\\filebeat.exe modules enable mssql# Install the template file.\\filebeat.exe setup -e# Start Filebeatstart-service filebeat
Uploading logs to CLS
In the
filebeat.yml file, change output.kafka to the following to send logs to CLS:output.kafka:enabled: truehosts: ["${region}-producer.cls.tencentyun.com:9095"] # TODO: Service address. The public network port is 9096, and the private network port is 9095.topic: "${topicID}" # TODO: Topic IDversion: "0.11.0.2"compression: "${compress}" # Configure the compression method. Valid values: `gzip`, `snappy`, `lz4`.username: "${logsetID}"password: "${SecurityId}#${SecurityKey}"
Parameter | Description |
LinkType | Currently, SASL_PLAINTEXT is supported. |
hosts | |
topic | Log topic ID, such as 76c63473-c496-466b-XXXX-XXXXXXXXXXXX. |
username | Logset ID, such as 0f8e4b82-8adb-47b1-XXXX-XXXXXXXXXXXX. |
password | Password in the format of ${SecurityId}#${SecurityKey}, such as XXXXXXXXXXXXXX#YYYYYYYY. |
Service Entries
Region | Network Type | Port Number | Service Entry |
Guangzhou | Private network | 9095 | gz-producer.cls.tencentyun.com:9095 |
| Public network | 9096 | gz-producer.cls.tencentcs.com:9096 |
Note:
This document uses the Guangzhou region as an example. The private and public domain names are identified by different ports. For other regions, replace the address prefixes. For more information, see here.
Yes
No
Was this page helpful?