Correct syntax for adding events?

[tomg1983]

What's the correct syntax for adding multiple event logs? So far, I only managed to add one like this:

    event_logs => {
        'options' => {
            'name' => 'Application',
            'ignore_older' => '72h',
        }
    },

thx!

[edestecd]

$event_logs = {
    'Security' => {
      'tags' => ['secure'],
    },
    'Another' => {
      'tags' => ['another'],
   }
  }

[f1ngerscr0ssed]

An example I have used:

$events = "4733, 4732, 1102, 4624, 4625, 4647"

class { 'winlogbeat':
  outputs => {
    'logstash'     => {
              'hosts' =>  [
                          'targethost:6655'
                          ],
              'ssl' => {
              'certificate'  => $puppet_cert_path,
              'key'          => $puppet_key_path, 
              },
           #   'index'            => 'winlogbeat',
         
          },
              },
event_logs => {
        
            'Security' => {
            'event_id' => $events, 
            'ignore_older' => '1h',
            },
 },
}

You have to fit all the event IDs inside a string,

Cheers!

[nsticco]

Would it be alright if I created a PR to add this to the documentation?

I assumed that it would be nested inside a winlogbeat property based on the official Elastic winlogbeat.yml example, but it looks like it's being nested in this automatically by the config.pp code.