Collect the Windows event log

How it works

To obtain event logs, Windows provides two APIs: Windows Event Log and Event Logging. The Windows Event Log API is an upgrade to the Event Logging API and is available only on Windows Vista and later. The Logtail plug-in automatically selects an API based on the operating system to obtain the Windows event log. Logtail preferentially selects the Windows Event Log API.

The Windows event log uses a publish-subscribe model. An application or the kernel publishes event logs to a specified channel, such as Application, Security, or System. Logtail uses the corresponding plug-in to call the Windows API and subscribe to these channels. This allows Logtail to continuously collect relevant event logs and send them to Simple Log Service.

Logtail supports collecting events from multiple channels simultaneously. For example, you can collect logs from the Application and System channels at the same time.

View channel information

You can view channel information in the Event Viewer on your Windows server.

1. Click Start.

2. Search for and open Event Viewer.

3. In the left-side navigation pane, expand Windows Logs or Applications and Services Logs.

4. View the full name and related information of the channel.

   Windows logs

   • Under Windows Logs, select the target channel, right-click and select Properties to view the full name of the channel. Examples include:

     • Application

     • Security

     • Setup

     • System

   • Under Windows Logs, click the target channel to view information such as the event level, date and time, source, and event ID in the central pane.

     You can use this information to filter logs in the Logtail configuration.

   Applications and services logs

   • Under Applications and Services Logs, select the target channel, right-click and select Properties to view the full name of the channel. For example:

     • Channel name for TerminalServices-LocalSessionManager/Operational.

     • Channel name for PowerShell/Operational.

Procedure

1. Log on to the Simple Log Service console.

2. In the Import Data section, click Windows Event Logs.

3. Select the destination project and Logstore, and then click Next.

4. In the Machine Group Configurations step, configure a machine group.

   1. Configure the Scenario and Installation Environment parameters as needed.

      Important

      You must configure the Scenario and Installation Environment parameters regardless of whether a machine group is available. The parameter settings affect subsequent configurations.

   2. Ensure that a machine group is displayed in the Applied Server Groups section, and click Next.

      Machine group available

      Select a machine group from the Source Machine Group section.

      

      No machine group available

      Click Create Machine Group. In the Create Machine Group panel, configure the parameters. You can set the Machine Group Identifier parameter to IP Address or Custom Identifier. For more information, see Create a custom identifier-based machine group or Create an IP address-based machine group.

      Important

      If you apply a machine group immediately after you create the machine group, the heartbeat status of the machine group may be FAIL. This issue occurs because the machine group is not connected to Simple Log Service. To resolve this issue, you can click Automatic Retry. If the issue persists, see What do I do if no heartbeat connections are detected on Logtail?

5. On the Configure Data Source tab, set Configuration Name and Plug-in Configuration, and then click Next.

   • inputs is required and is used to configure the data source settings for the Logtail configuration.

     Important

     You can specify only one type of data source in inputs.

   • processors is optional and is used to configure the data processing settings for the Logtail configuration to parse data. You can specify one or more processing methods.

     If your logs cannot be parsed based only on the setting of inputs, you can configure processors in the Plug-in Configuration field to add plugins for data processing. For example, extract fields, extract log time, mask data, and filter logs. For more information, see Logtail plugins for data processing.

   For example, to collect logs from the Application, System, and TerminalServices-LocalSessionManager/Operational channels, you can add the following configuration to inputs.

   {
       "inputs": [
           {
               "type": "service_wineventlog",
               "detail": {
                   "Name": "Application",
                   "IgnoreOlder": 259200
               }
           },
           {
               "type": "service_wineventlog",
               "detail": {
                   "Name": "System",
                   "IgnoreOlder": 259200
               }
           },
           {
               "type": "service_wineventlog",
               "detail": {
                   "Name": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational",
                   "IgnoreOlder": 259200
               }
           }      
       ]
   }

   Parameter	Type	Required	Description
   type	String	Yes	The type of the data source. Set the value to service_wineventlog.
   Name	String	Yes	The name of the channel from which you want to collect event logs. If you do not configure this parameter, Logtail collects logs from the Application channel by default. You can view the full name of the channel in Windows. For more information, see View channel information.
   IgnoreOlder	UINT	No	This parameter specifies a time offset in seconds from the collection start time. Logtail ignores logs generated before this offset. For example: If you set this parameter to 3600, logs generated more than one hour before the collection starts are ignored. If you set this parameter to 14400, logs generated more than four hours before the collection starts are ignored. By default, this parameter is empty, which indicates that all historical event logs on the server are collected. Note This option takes effect only during the initial collection. Logtail records a checkpoint for event collection to prevent duplicate collection.
   Level	String	No	Filters logs based on the event level. The default value is information, warning, error, critical, which collects all logs except for those at the verbose level. Valid values: information, warning, error, critical, and verbose. You can specify multiple levels by separating them with commas (,). Note This parameter is available only on Windows Vista and later operating systems.
   EventID	String	No	Filters logs based on the event ID. You can specify an allowlist (a single ID or a range) or a denylist (ranges are not supported). By default, this parameter is empty, which indicates that all events are collected. For example: 1-200: Collects only event logs with IDs ranging from 1 to 200. 20: Collects only event logs with an ID of 20. -100: Collects all event logs except for those with an ID of 100. 1-200,-100: Collects event logs with IDs in the range of 1 to 200, excluding those with an ID of 100. You can specify multiple values by separating them with commas (,). Note This parameter is available only on Windows Vista and later operating systems.
   Provider	String array	No	Filters logs based on the event source. For example, if you set this parameter to ["App1", "App2"], only event logs from the App1 and App2 sources are collected. All other event logs are ignored. By default, this parameter is empty, which indicates that events from all sources are collected. Note This parameter is available only on Windows Vista and later operating systems.
   IgnoreZeroValue	Boolean	No	Not every event log has all fields. You can use this parameter to filter out empty fields. The definition of an empty field depends on its type. For example, an empty integer field is represented by 0. The default value is false, which indicates that empty fields are not filtered.

6. Create indexes and preview data. Then, click Next. By default, full-text indexing is enabled in Simple Log Service. You can also manually create field indexes for the collected logs or click Automatic Index Generation. Then, Simple Log Service generates field indexes. For more information, see Create indexes.

   Important

   If you want to query all fields in logs, we recommend that you use full-text indexes. If you want to query only specific fields, we recommend that you use field indexes. This helps reduce index traffic. If you want to analyze fields, you must create field indexes. You must include a SELECT statement in your query statement for analysis.

7. Click Query Log to go to the query and analysis page for the Logstore.

   You must wait about one minute for the indexes to take effect. You can then view the collected logs on the Raw Logs tab. For more information, see Quick start for log query and analysis.

Troubleshooting

If no data appears on the preview or query page after you configure Logtail, see Troubleshoot Logtail log collection failures.