New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

支持解析Windows Event日志格式 #213

Closed

darkr4y opened this issue Nov 22, 2017 · 3 comments

Labels

feature request

darkr4y commented Nov 22, 2017

包括 Nt5 下的 evt 格式
以及 Nt6 下的 evtx 格式

wonderflow added the feature request label

Contributor

wonderflow commented Mar 1, 2018

@darkr4y 可以发一些日志的样例吗

Author

darkr4y commented Mar 1, 2018

Contributor

wonderflow commented Mar 1, 2018

logkit支持grok的方式配置解析 https://github.com/qiniu/logkit/wiki/Grok-Parser
可以配置一个grok的Pattern： https://stackoverflow.com/questions/33390900/logstash-parse-windows-event-id-1102?rq=1

wonderflow closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment