​

Windowseventlog Receiver

​

Supported Telemetry

​

Overview

​

Configuration Fields

​

Feature Gates

​

Operators

• Every operator has a type.
• Every operator can be given a unique id. If you use the same type of operator more than once in a pipeline, you must specify an id. Otherwise, the id defaults to the value of type.
• Operators will output to the next operator in the pipeline. The last operator in the pipeline will emit from the receiver. Optionally, the output parameter can be used to specify the id of another operator to which logs will be passed directly.
• Only parsers and general purpose operators should be used.

​

Additional Terminology and Features

• An entry is the base representation of log data as it moves through a pipeline. All operators either create, modify, or consume entries.
• A field is used to reference values in an entry.
• A common expression syntax is used in several operators. For example, expressions can be used to filter or route entries.
• timestamp parsing is available as a block within all parser operators, and also as a standalone operator. Many common timestamp layouts are supported.
• severity parsing is available as a block within all parser operators, and also as a standalone operator. Stanza uses a flexible severity representation which is automatically interpreted by the stanza receiver.

​

Example Configurations

​

Simple

receivers:
    windowseventlog:
        channel: application

{
    "channel": "Application",
    "computer": "computer name",
    "event_id":
    {
        "id": 10,
        "qualifiers": 0
    },
    "event_data":
    {
        "ProcessId": "7924",
        "Application": "app.exe"
    },
    "keywords": ["Classic"],
    "level": "Information",
    "message": "Test log",
    "opcode": "Info",
    "provider":
    {
        "event_source": "",
        "guid": "",
        "name": "otel"
    },
    "record_id": 12345,
    "rendering_info":
    {
        "channel": "Application",
        "culture": "en-US",
        "keywords": ["Classic"],
        "level": "Information",
        "message": "Test log",
        "opcode": "Info",
        "provider": "otel",
        "task": ""
    },
    "system_time": "2022-04-15T15:28:08.898974100Z",
    "task": ""
}

{
    "event_data": {
        "data": [
            {"ProcessId": "7924"},
            {"Application": "app.exe"}
        ]
    }
}

{
    "user_data": {
        "name": "LogFileCleared",
        "data": {
            "SubjectUserName": "SYSTEM",
            "SubjectLogonId": "0x3e7"
        }
    }
}

​

Remote Configuration

• The remote computer must enable the “Remote Event Log Management” Windows Firewall exception. Otherwise, when you try to use the session handle, the call will error with RPC_S_SERVER_UNAVAILABLE.
• The computer to which you are connecting must be running Windows Vista or later.

receivers:
    windowseventlog:
        channel: application
        remote:
            server:   "remote-server"
            username: "user"
            password: "password"
            domain:   "domain"

​

XML Queries

receivers:
  windowseventlog/query:
    query: |
      <QueryList>
        <Query Id="0">
          <Select Path="Application">*[System[Provider[@Name='foo']]]</Select>
          <Select Path="Application">*[System[Provider[@Name='bar']]]</Select>
        </Query>
      </QueryList>

​

SID Resolution

• Automatically enriches Windows events with resolved user and group names
• High-performance LRU cache with configurable size and TTL
• Resolves well-known SIDs (SYSTEM, LOCAL_SERVICE, etc.) instantly from static map
• Works with domain-joined machines to resolve domain users and groups
• Non-breaking: original SID values are preserved alongside resolved names

receivers:
  windowseventlog:
    channel: Security
    resolve_sids:
      enabled: true        # Enable SID resolution
      cache_size: 10000    # Cache up to 10,000 SID-to-name mappings
      cache_ttl: 15m       # Re-resolve SIDs after 15 minutes

{
  "security": {
    "user_id": "S-1-5-21-3623811015-3361044348-30300820-1013"
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-18",
    "TargetUserSid": "S-1-5-21-3623811015-3361044348-30300820-1013"
  }
}

{
  "security": {
    "user_id": "S-1-5-21-3623811015-3361044348-30300820-1013",
    "user_name": "ACME\\jsmith",
    "domain": "ACME",
    "account": "jsmith",
    "account_type": "User"
  },
  "event_data": {
    "SubjectUserSid": "S-1-5-18",
    "SubjectUserSid_Resolved": "NT AUTHORITY\\SYSTEM",
    "SubjectUserSid_Domain": "NT AUTHORITY",
    "SubjectUserSid_Account": "SYSTEM",
    "SubjectUserSid_Type": "WellKnownGroup",
    "TargetUserSid": "S-1-5-21-3623811015-3361044348-30300820-1013",
    "TargetUserSid_Resolved": "ACME\\jsmith",
    "TargetUserSid_Domain": "ACME",
    "TargetUserSid_Account": "jsmith",
    "TargetUserSid_Type": "User"
  }
}

• Cache hit latency: < 1 microsecond
• Cache miss latency: < 5 milliseconds (Windows LSA API call)
• Expected cache hit rate: > 99% in steady state
• Memory usage: ~100 bytes per cached entry
• Throughput impact: < 5% with cache enabled

• Only resolves SIDs for the local system or the domain the Windows machine is joined to
• Cannot resolve SIDs from trusted domains (requires LDAP extension)
• Remote collection: SID resolution only works when the collector runs on Windows
• Cache lifecycle: Cache is created at receiver start and closed at shutdown

1. Check logs for initialization message:
   INFO SID resolution enabled {"cache_size": 10000, "cache_ttl": "15m0s"}
   
2. Verify the collector is running on Windows: SID resolution only works on Windows operating systems.
3. Check for resolution errors: Failed SID lookups are logged at DEBUG level:
   DEBUG Failed to resolve SID {"sid": "S-1-5-21-...", "error": "..."}
   
4. Verify SID format: Only fields ending with “Sid” or named “UserID” are automatically resolved. Custom SID fields may not be detected.

• S-1-5-18 - NT AUTHORITY\SYSTEM
• S-1-5-19 - NT AUTHORITY\LOCAL SERVICE
• S-1-5-20 - NT AUTHORITY\NETWORK SERVICE
• S-1-5-32-544 - BUILTIN\Administrators
• S-1-1-0 - Everyone
• And 40+ more common Windows SIDs

​

Configuration

​

Example Configuration

windowseventlog:
  start_at: end
  channel: application