Skip to content

[winlog] Expose forwarded option in winlog #18500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
marc-gr wants to merge 2 commits into
base: main
Choose a base branch
from
+21 −1
Open

[winlog] Expose forwarded option in winlog #18500

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9400db2
Expose forwarded option in winlog
marc-gr Apr 17, 2026
379ef03
Change description
marc-gr Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions packages/winlog/agent/input/winlog.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@ condition: ${host.platform} == 'windows'
data_stream:
dataset: {{data_stream.dataset}}
name: {{channel}}
{{#if forwarded}}
forwarded: true
{{/if}}
{{#if xml_query}}
xml_query: {{xml_query}}
{{else}}
Expand Down
5 changes: 5 additions & 0 deletions packages/winlog/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.6.0"
changes:
- description: Add `forwarded` option to winlog input.
type: enhancement
link: https://github.com/elastic/integrations/pull/18500
Comment thread
macroscopeapp[bot] marked this conversation as resolved.
- version: "2.5.0"
changes:
- description: Improve documentation
Expand Down
14 changes: 13 additions & 1 deletion packages/winlog/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: winlog
title: Custom Windows Event Logs
description: Collect and parse logs from any Windows event log channel with Elastic Agent.
type: input
version: "2.5.0"
version: "2.6.0"
conditions:
kibana:
version: '^8.10.1 || ^9.0.0'
Expand Down Expand Up @@ -52,6 +52,18 @@ policy_templates:
type: bool
multi: false
default: false
- name: forwarded
required: true
show_user: true
title: Forwarded events
description: >-
Indicates if this will be consuming forwarded events. If `true` the integration will assume the events
were not generated in the host. This MUST be set to `true` if the integration is consuming forwarded events
like in WEF setups, otherwise the integration could run in a degraded state due to inconsistencies in the events
correlation. If the channel being consumed is `ForwardedEvents` this is going to be set to `true` regardless of the value set here.
type: bool
multi: false
default: false
- name: providers
type: text
title: Providers
Expand Down
Loading