Security Moduleedit

The security module processes event log records from the Security log.

Configurationedit

winlogbeat.event_logs:
  - name: Security

output.elasticsearch.pipeline: winlogbeat-%{[agent.version]}-routing 

All module processing is handled via Elasticsearch Ingest Node pipelines. See Setup of Ingest Node pipelines for details.