winlogbeat-ship2helk.yml

#### Winlogbeat Evtx Shipper To HELK ####

# Usage: .\winlogbeat.exe -c .\winlogbeat-ship2helk.yml -e -E EVTX_FILE="C:\Dev\evtxfile2ship.evtx"

winlogbeat.event_logs:
 - name: ${EVTX_FILE}
   no_more_events: stop
winlogbeat.shutdown_timeout: 60s
winlogbeat.registry_file: evtx-registry.yml

# If sending directly to logstash, you will need to change the output module
output.kafka:
  hosts: ["<HELK-IP>:9092"]
  topic: "winlogbeat"
  max_retries: 2
  max_message_bytes: 1000000