search

fluent / fluent-plugin-windows-eventlog

Fluentd plugin to collect windows event logs
Apache License 2.0
33 stars 19 forks source link

Parsing Keys from EventData #110

Closed BlakeHensleyy closed 1 month ago

BlakeHensleyy commented 3 months ago

Is there a way to parse EventData with the fields included rather than parsing the Description with the description fields?

I'd like to use the field names from EventData because NXlog is supported by my event collector and this is what NXlog does. For example, in the Security log 4624, is the EventData fields "TargetLogonId", "TargetUserName", and "TargetUserSid". While, parsed from the Description these fields are "new_logon_logon_id", "new_logon_account_name", and "new_logon_security_id". I was able to get the keys to be in Camel case without underscores by editing the to_key function:

def to_key(key)
     key.gsub!(' '.freeze, ''.freeze)
     key
 end

and by removing the period on line 392 to be:

k = "#{parent_key}#{to_key(key)}"

After these changes, the fields are "NewLogonLogonId", "NewLogonAccountName", and "TargetSubjectSecurityID" which still is not the desired field names. I've realized that what I want is probably only achievable from the XML Key values in the Windows events by default.

Is there a configuration setting that achieves this? Or should I attempt my own implementation of it? I would also be ok with solution described in issue #95, if that goes anywhere.

daipom commented 3 months ago

Thanks for the report. I understand the issue, as well as #95.

I've realized that what I want is probably only achievable from the XML Key values in the Windows events by default.

We would need the #95 feature for this, but it would not be possible now, as I commented on https://github.com/fluent/fluent-plugin-windows-eventlog/issues/95#issuecomment-2177580285. Please let us know if you know how to use Win32 API to take the Data Name of EventData.

I was able to get the keys to be in Camel case without underscores by editing the to_key function

It would not be enough for this issue, but if you need this feature, we should improve this plugin. Welcome to PR!

BlakeHensleyy commented 3 months ago

Thanks for the response, @daipom!

I'm also not sure how to use the API to take the Data Name of EventData. I did try looking into the Winlogbeat source code because I know that Winlogbeat, like NXlog, does parse the EventData. While I do believe something useful for fluent-plugin-windows-eventlog2 could be gleaned from this, I'm just not sure how to identify and implement it.

Currently I have very little Ruby and general API experience, but in the future if I have the time to look further into this then I'll give it a try.