Skip to main content

Output Configuration

The output section of winlogbeat.yml defines where collected events are sent. The 262COS configuration forwards all events to the DIP Logstash pipeline on port 5045/TCP.

Logstash Output​

output.logstash:
  hosts: ["<DIP_EXTERNAL_IP>:5045"]
  ssl.enabled: true
  ssl.verification_mode: "none"

Replace <DIP_EXTERNAL_IP> with the DIP's external IP address for the mission network.

TFPlenum Configs

If the winlogbeat.yml came from a TFPlenum package built on a DIP configured IAW 262COS-DIP-SOP-001, the output is already configured to point to the correct DIP External IP at 5045/TCP. No changes to the output section should be needed.

If Using a Vanilla CVA/H DIP

On a DIP not built with 262COS-DIP-SOP-001, the Logstash pipeline and certificates may be configured differently. In that case, uncomment the certificate lines and point them to the correct cert files:

output.logstash:
  hosts: ["<DIP_EXTERNAL_IP>:5045"]
  ssl.certificate_authorities: ["${path.home}/ca.crt"]
  ssl.certificate: "${path.home}/tls.crt"
  ssl.key: "${path.home}/tls.key"
  ssl.enabled: true
  ssl.verification_mode: "none"

Why SSL Certificate Files Are Omitted​

The 262COS base config intentionally omits ssl.certificate_authorities, ssl.certificate, and ssl.key. If the DIP is rebuilt or redeployed:

  1. New TLS certificates are generated automatically.
  2. Agents pinned to the old certificate files will fail to reconnect with a TLS handshake error.
  3. Every deployed host would require a manual config update to reference the new certs.

By using ssl.verification_mode: "none", agents will connect over TLS without verifying the server certificate — eliminating cert-related reconnect failures while maintaining an encrypted transport.

Global Processors​

Global processors apply to all events regardless of channel. The standard 262COS config includes:

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  • add_host_metadata: Appends the collecting host's metadata (hostname, IP, OS) to each event. The when.not.contains.tags: forwarded condition skips this for ForwardedEvents, which should retain the originating host's identity rather than the forwarder's.
  • add_cloud_metadata: Detects and appends cloud provider metadata (AWS, Azure, GCP) if the host is running in a cloud environment. Has no effect on bare-metal or on-prem hosts.

Logging Configuration​

Controls Winlogbeat's own operational log output. Useful for troubleshooting collection issues.

logging.to_files: true
logging.files:
  path: C:\ProgramData\winlogbeat\Logs
logging.level: info
  • logging.level options: debug, info, warning, error, critical. Use debug temporarily when troubleshooting; revert to info for normal operations to avoid log bloat.