Alright so I am confuse,I can forward application,security and system logs. But how do I forward sysmon logs located at Application and Services/Microsoft/Windows/Sysmon
I can't find any documentation. Here's my current conf file.
<source>
@type windows_eventlog2
@id windows_eventlog2
channels application,system,security
tag system
render_as_xml true
<storage>
persistent false
</storage>
parse_description false
read_existing_events false
</source>
<match system.**>
@type kinesis_firehose
region xxx
delivery_stream_name xxx
aws_key_id xxx
aws_sec_key xxx
<assume_role_credentials>
duration_seconds 3600
role_arn xxx
role_session_name "xxx"
</assume_role_credentials>
<format>
@type json
</format>
</match>