winlogbeat的安裝使用

獲取安裝包

winlogbeat下載地址：https://www.elastic.co/cn/downloads/beats/winlogbeat

安裝步驟

1. 解壓到d:\

2. 以管理員身份打開PowerShell
   

3. 進入winlogbeat解壓後的目錄：
   cd d:\winlogbeat

4. 執行安裝腳本
   .\install-service-winlogbeat.ps1

注意： 如果在系統上禁用了腳本執行，則需要爲當前會話設置執行策略以允許腳本運行。 PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-winlogbeat.ps1

5. 啓動winlogbeat服務
   Start-Service winlogbeat

停止wilogbeat服務

Stop-Service winlogbeat

卸載winlogbeat

.\uninstall-service-winlogbeat.ps1

安裝腳本

winlogbeat_install1.bat

::直接雙擊運行該文件
::解壓winlogbeat到d:\根目錄中
@title install winlogbeat
set "rar=C:\Program Files\WinRAR\WinRAR.exe"
if exist winlogbeat.zip (
    "%rar%" x -ad -y winlogbeat.zip  d:\
)
@echo on
timeout /nobreak /t 10 >nul

winlogbeat_install2.bat

::以管理員身份運行此文件，winlogbeat安裝在d:\winlogbeat中，如位置變化，請更改對應路徑
@echo on
::進入winlogbeat所在的盤
d:
::進入winlogbeat安裝目錄
cd winlogbeat

::安裝winlogbeat服務
Powershell.exe  -ExecutionPolicy UnRestricted -File install-service-winlogbeat.ps1
::啓動winlogbeat
Powershell.exe Start-Service winlogbeat

::停掉winlogbeat服務
::Powershell.exe Stop-Service winlogbeat
::卸載winlogbeat
::Powershell.exe -file uninstall-service-winlogbeat.ps1

timeout /nobreak /t 10 >nul

配置文件

winlogbeat.yml