Reading Time: < 1 minute
1 . Once the program is installed, we need to edit its configuration file called “winlogbeat.yml” and make some changes to make it work with BLËSK. To do this, you edit the Winlogbeat configuration file to disable the Elasticsearch output by commenting it out and enable the Logstash output by uncommenting the logstash section.
The hosts option specifies the BLËSK server IP and the port (5044) where BLËSK is configured to listen for incoming log connections. In our example, the IP of BLËSK is 1.2.3.4 and we send logs on port 5044.
2 . After you save your configuration file, test it with the following command.
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe -c .\winlogbeat.yml -configtest -e
