This section contains detailed information about the available Windows event log processing modules contained in Winlogbeat. More details about each module can be found in the module’s documentation.
Winlogbeat modules are constructed using the script processor where all processing happens within Winlogbeat before the events are delivered to the output.
The general goal of each module is to transform events by renaming fields to comply with the Elastic Common Schema (ECS). The modules may also apply additional categorization, tagging, and parsing as necessary.
The default configuration file included in packages has each of the modules
configured. To apply the modules to your own configuration file you must add
script processor to your configuration file and point it at the included
script file for the module. The documentation for each module includes an
ForwardedEvents channel can contain events from multiple producers so you
may want to use multiple modules. This can be achieved by applying multiple
script processors that are guarded by a conditional