dgunter / evtxtoelk

A lightweight tool to load Windows Event Log evtx files into Elasticsearch.

EvtxtoElk

A lightweight tool to load Windows Event Log evtx files into Elasticsearch.

Examples

We wrote a blog on basic usage here https://dragos.com/blog/20180717EvtxToElk.html

More details will be posted here shortly.

evtxtoelk's Issues

No module named "evtxtoelk"

Hi, sorry,

maybe it´s a beginner question but I´m trying to figure out how the parser works. I followed the instructions from the "https://dragos.com/blog/industry-news/evtxtoelk-a-python-module-to-load-windows-event-logs-into-elasticsearch/" site and I got the point where I need to load windows logs to elk. I get this message:

• ModuleNotFindError: No module named ´evtxtoelk´.

What am I missing? Thanks a lot for any help.

EVTXtoELK SSL Certificate Validation Error

When using this and trying to send the logs to elastic, if xpack.security is enabled it forces all connections to use SSL. If the server has a self signed certificate the connection will fail.

Solution:

Implement a way to ignore certificate errors

parameter [_type]

Hello, I'm trying to use your script to import a Security.evtx file into Elasticsearch 8.4.2 but I'm getting the following error while trying to do so:

elasticsearch.BadRequestError: BadRequestError(400, 'illegal_argument_exception', 'Action/metadata line [1] contains an unknown parameter [_type]')
None
Failed to bulk data to Elasticsearch

How can I solve this?

Thank you advance.

Script adding body. to every field

Hi, thanks for the tool. When I use the tool to import the data, it's adding "body." to every field. Is it possible to remove this entry?

Had to comment out _type field

I just used this tool on linux to import into and ELK stack. Works great, but I had to comment out the line that assigned a _type field because it Elasticsearch said that field value was invalid. This is with ES 8.3.3

Otherwise, works great.

Parsing exception when trying to ingest System.evtx

Hi there! Great tool, I got it to ingest Security.evtx and Application.evtx, but when I try to ingest System.evtx I always get a parsing error. I have a very basic understanding of programming logic, not nearly that about Python - I got most of it to work with your step-by-step on Dragos' blog and some Google-fu. How can I help diagnose, maybe even help correct, this parsing error?

oh! Found one on Elasticsearch's logs:

Caused by: java.lang.IllegalArgumentException: object field starting or ending with a [.] makes object resolution ambiguous: [.NETServiceMethod]

And rolling up the log, it seems every parsing error is caused because of this error.