How to use fluentd to forward sysmon logs?

Viewed 11

Alright so I am confuse,I can forward application,security and system logs. But how do I forward sysmon logs located at Application and Services/Microsoft/Windows/Sysmon

I can't find any documentation. Here's my current conf file.

<source>
  @type windows_eventlog2
  @id windows_eventlog2
  channels application,system,security
  tag system
  render_as_xml true
  <storage>
    persistent false
  </storage>
  parse_description false
  read_existing_events false
</source>
<match system.**>
  @type kinesis_firehose
  region xxx
  delivery_stream_name xxx
  aws_key_id xxx
  aws_sec_key xxx
  <assume_role_credentials>
    duration_seconds 3600
    role_arn xxx
    role_session_name "xxx"
  </assume_role_credentials>
  <format>
    @type json
  </format>
</match>
0 Answers
Related