winlogbeat.yml

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
  - name: Security
  - name: System
  - name: ForwardedEvents
    forwarded: true
    ignore_older: 360h
#    ignore_older: 2160h
#================================ General =====================================
fields:
  logsource: windowsEventForwarding
  subtype: ClientComputers
  #subtype: Servers
  #subtype: ActiveDirectory

#================================ Outputs =====================================
#----------------------------- Kafka output --------------------------------
output.kafka:
  # initial brokers for reading cluster metadata
  hosts: ["kafka.server.one:9092","kafka.server.two:9092","kafka.server.three:9092"]

  # message topic selection + partitioning
  topic: windows
  partition.round_robin:
    reachable_only: false
  worker: 6
  bulk_max_size: 4096
  required_acks: 1
  compression: gzip
  max_message_bytes: 1000000