Grafana Alloy for sending Windows Event Logs

Ask AI
1

Hello,
I want to send all Event IDs 4660 along with username, file and folder name, hostname, IP address and date and time to a Loki server with IP address 192.168.1.2.
Please write me the Alloy configuration file.

Thank you.

2

To send specific Windows Event Logs, such as Event ID 4660, along with additional details like username, file and folder name, hostname, IP address, and date and time to a Loki server using Grafana Alloy, you can use the following configuration. This setup assumes you have the necessary permissions and access to the Windows Event Logs and that your Loki server is accessible at http://192.168.1.2:3100/loki/api/v1/push.

Here's a sample configuration for your config.alloy file:

loki.source.windowsevent "logs_integrations_windows_exporter_security" {
  locale                 = 1033
  eventlog_name          = "Security"
  bookmark_path          = "./bookmarks-security.xml"
  poll_interval          = "0s"
  use_incoming_timestamp = true
  forward_to             = [loki.relabel.logs_integrations_windows_exporter_security.receiver]
  labels                 = {
    instance = constants.hostname,
    job      = "integrations/windows_exporter",
  }
  xpath_query            = "*[System[(EventID=4660)]]"
}

loki.relabel "logs_integrations_windows_exporter_security" {

forward_to = [loki.process.logs_integrations_windows_exporter_security.receiver]


rule {

source_labels = ["computer"]

target_label  = "agent_hostname"

}

}


loki.process "logs_integrations_windows_exporter_security" {

forward_to = [loki.write.grafana_loki.receiver]


stage.json {

expressions = {

username   = "EventData.Data[@Name=‘SubjectUserName’]",

file       = "EventData.Data[@Name=‘ObjectName’]",

folder     = "EventData.Data[@Name=‘ObjectType’]",

hostname   = "System.Computer",

ip_address = "EventData.Data[@Name=‘IpAddress’]",

timestamp  = "System.TimeCreated.@SystemTime",

}

}


stage.labels {

values = {

username   = "",

file       = "",

folder     = "",

hostname   = "",

ip_address = "",

timestamp  = "",

}

}

}


loki.write "grafana_loki" {

endpoint {

url = "http://192.168.1.2:3100/loki/api/v1/push"

}

}

Explanation:

  • loki.source.windowsevent: This component is configured to read from the "Security" event log and filter for Event ID 4660. The xpath_query is used to filter events.
  • loki.relabel: This component relabels the agent_hostname from the computer field.
  • loki.process: This component processes the logs, extracting fields like username, file, folder, hostname, ip_address, and timestamp using JSON expressions.
  • loki.write: This component sends the processed logs to your Loki server at the specified URL.

Make sure to adjust the xpath_query and JSON expressions according to the actual structure of your Windows Event Logs if they differ. Also, ensure that the network and firewall settings allow communication between your Alloy instance and the Loki server.

grot is still learning and improving, please let me know how I did by reacting below.

👍🏽 or 👎🏽

3

Do I only need to install Grafana Alloy on Windows?

4

To send Windows Event Logs to a Loki server using Grafana Alloy, you will need to install Grafana Alloy on the Windows machine from which you want to collect the logs. This is because the loki.source.windowsevent component, which is responsible for reading Windows Event Logs, needs to run on the Windows system where the logs are generated.

Here are the steps you should follow:

  1. Install Grafana Alloy: Install Grafana Alloy on the Windows machine. This will allow you to configure and run the necessary components to collect and forward logs.

  2. Configure Alloy: Use the configuration provided by @grafanabot to set up the loki.source.windowsevent, loki.relabel, loki.process, and loki.write components. This configuration will filter for Event ID 4660 and extract the required fields before sending them to your Loki server.

  3. Network Configuration: Ensure that the Windows machine can communicate with the Loki server at 192.168.1.2:3100. This may involve configuring firewalls or network settings to allow traffic between the two systems.

  4. Permissions: Make sure that the user account running Grafana Alloy has the necessary permissions to read from the Windows Event Logs.

By following these steps, you should be able to successfully send the specified Windows Event Logs to your Loki server. If you have any further questions or run into issues, feel free to ask for more help!

grot is still learning and improving, please let me know how I did by reacting below.

👍🏽 or 👎🏽

5

I will test the configuration file tomorrow and let you know if there are any problems.

6

Great! It sounds like you're on the right track. When you test the configuration, make sure to verify the following:

  1. Event Log Access: Ensure that Grafana Alloy has the necessary permissions to access the Windows Event Logs. This might require running the service with elevated privileges.

  2. Network Connectivity: Double-check that the Windows machine can reach the Loki server at 192.168.1.2:3100. You might need to adjust firewall settings or network configurations to allow this communication.

  3. Configuration Accuracy: Ensure that the XPath query and JSON expressions in your configuration file accurately reflect the structure of your Windows Event Logs. You may need to adjust these if the logs have a different format.

  4. Log Verification: After setting up, verify that the logs are being sent to Loki by checking the Loki server for incoming logs. You can use Grafana to visualize and confirm that the logs are being received correctly.

If you encounter any issues or have further questions during your testing, feel free to reach out for more assistance. Good luck with your setup!

grot is still learning and improving, please let me know how I did by reacting below.

👍🏽 or 👎🏽

7

Hello,
I got the following error:

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:24:1: Failed to build component: building component: invalid stage config could not compile JMES expression: SyntaxError: Expected tStar, received: tCurrent

23 |   
24 |   loki.process "logs_integrations_windows_exporter_security" {
   |  _^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
25 | |   forward_to = [loki.write.grafana_loki.receiver]
26 | | 
27 | |   stage.json {
28 | |     expressions = {
29 | |       username   = "EventData.Data[@Name='SubjectUserName']",
30 | |       file       = "EventData.Data[@Name='ObjectName']",
31 | |       folder     = "EventData.Data[@Name='ObjectType']",
32 | |       hostname   = "System.Computer",
33 | |       ip_address = "EventData.Data[@Name='IpAddress']",
34 | |       timestamp  = "System.TimeCreated.@SystemTime",
35 | |     }
36 | |   }
37 | | 
38 | |   stage.labels {
39 | |     values = {
40 | |       username   = "",
41 | |       file       = "",
42 | |       folder     = "",
43 | |       hostname   = "",
44 | |       ip_address = "",
45 | |       timestamp  = "",
46 | |     }
47 | |   }
48 | | }
   | |_^
49 |   

interrupt received
ts=2025-02-11T05:45:38.2771206Z level=error msg="failed to start reporter" err="context canceled"
ts=2025-02-11T05:45:38.2771206Z level=error msg="failed to evaluate config" controller_path=/ controller_id="" node=loki.process.logs_integrations_windows_exporter_security err="building component: invalid stage config could not compile JMES expression: SyntaxError: Expected tStar, received: tCurrent"
Error: could not perform the initial load successfully
8

The error you're encountering suggests there is an issue with the JMESPath expressions used in the stage.json block of your configuration. The error message indicates a syntax issue, likely due to the way the expressions are written.

Here are a few steps to troubleshoot and correct the configuration:

  1. Check JMESPath Syntax: Ensure that the JMESPath expressions are correctly formatted. JMESPath is a query language for JSON, and it requires specific syntax. The expressions should be valid JMESPath queries.

  2. Correct Quotes: Ensure that you are using the correct type of quotes. In your configuration, it seems like there might be a mix of different quote types. Use single quotes (') consistently for JMESPath expressions.

  3. Validate Expressions: Double-check each expression to ensure it matches the structure of your Windows Event Logs. You might need to adjust the expressions based on the actual JSON structure of the logs.

Here's a revised version of your configuration with corrected quotes and expressions:

loki.source.windowsevent "logs_integrations_windows_exporter_security" {
  locale                 = 1033
  eventlog_name          = "Security"
  bookmark_path          = "./bookmarks-security.xml"
  poll_interval          = "0s"
  use_incoming_timestamp = true
  forward_to             = [loki.relabel.logs_integrations_windows_exporter_security.receiver]
  labels                 = {
    instance = constants.hostname,
    job      = "integrations/windows_exporter",
  }
  xpath_query            = "*[System[(EventID=4660)]]"
}

loki.relabel "logs_integrations_windows_exporter_security" {

forward_to = [loki.process.logs_integrations_windows_exporter_security.receiver]


rule {

source_labels = ["computer"]

target_label  = "agent_hostname"

}

}


loki.process "logs_integrations_windows_exporter_security" {

forward_to = [loki.write.grafana_loki.receiver]


stage.json {

expressions = {

username   = "EventData.Data[?@.Name==‘SubjectUserName’].Value | [0]",

file       = "EventData.Data[?@.Name==‘ObjectName’].Value | [0]",

folder     = "EventData.Data[?@.Name==‘ObjectType’].Value | [0]",

hostname   = "System.Computer",

ip_address = "EventData.Data[?@.Name==‘IpAddress’].Value | [0]",

timestamp  = "System.TimeCreated.@SystemTime",

}

}


stage.labels {

values = {

username   = "",

file       = "",

folder     = "",

hostname   = "",

ip_address = "",

timestamp  = "",

}

}

}


loki.write "grafana_loki" {

endpoint {

url = "http://192.168.1.2:3100/loki/api/v1/push"

}

}

Key Changes:

  • Quotes: Ensure all JMESPath expressions use single quotes consistently.
  • JMESPath Expressions: Adjusted the expressions to use JMESPath filtering and projection syntax, which is more robust for extracting values from arrays of objects.

After making these changes, try running the configuration again. If you continue to encounter issues, you may need to further adjust the expressions based on the exact structure of your event logs. You can use tools like JMESPath Terminal to test and validate your expressions against sample JSON data.

grot is still learning and improving, please let me know how I did by reacting below.

👍🏽 or 👎🏽

9

My configurations is:

loki.source.windowsevent "logs_integrations_windows_exporter_security" {
  locale                 = 1033
  eventlog_name          = "Security"
  bookmark_path          = "./bookmarks-security.xml"
  poll_interval          = "0s"
  use_incoming_timestamp = true
  forward_to             = [loki.relabel.logs_integrations_windows_exporter_security.receiver]
  labels                 = {
    instance = constants.hostname,
    job      = "integrations/windows_exporter"
  }
  xpath_query            = "*[System[(EventID=4660)]]"
}

loki.relabel "logs_integrations_windows_exporter_security" {
  forward_to = [loki.process.logs_integrations_windows_exporter_security.receiver]
  rule {
    source_labels = ["computer"]
    target_label  = "agent_hostname"
  }
}

loki.process "logs_integrations_windows_exporter_security" {
  forward_to = [loki.write.grafana_loki.receiver]
  stage.json {
    expressions = {
      username   = "EventData.Data[?@.Name=='SubjectUserName'].Value | [0]"
      file       = "EventData.Data[?@.Name=='ObjectName'].Value | [0]"
      folder     = "EventData.Data[?@.Name=='ObjectType'].Value | [0]"
      hostname   = "System.Computer"
      ip_address = "EventData.Data[?@.Name=='IpAddress'].Value | [0]"
      timestamp  = "System.TimeCreated.@SystemTime"
    }
  }
  stage.labels {
    values = {
      username   = ""
      file       = ""
      folder     = ""
      hostname   = ""
      ip_address = ""
      timestamp  = ""
    }
  }
}

loki.write "grafana_loki" {
  endpoint {
    url = "http://192.168.1.2:3100/loki/api/v1/push"
  }
}

I got the following error:

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:10:47: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:27:76: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:28:71: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:29:71: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:30:37: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:31:70: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:32:52: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:37:22: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:38:22: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:39:22: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:40:22: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:41:22: missing ',' in field list

Error: C:\Program Files\GrafanaLabs\Alloy\config.alloy:42:22: missing ',' in field list
10

The errors you're encountering indicate that there are missing commas in your configuration file. In HCL (HashiCorp Configuration Language), which is used by Grafana Alloy, commas are required to separate items in a list or map. Let's correct your configuration by ensuring that all necessary commas are included:

loki.source.windowsevent "logs_integrations_windows_exporter_security" {
  locale                 = 1033
  eventlog_name          = "Security"
  bookmark_path          = "./bookmarks-security.xml"
  poll_interval          = "0s"
  use_incoming_timestamp = true
  forward_to             = [loki.relabel.logs_integrations_windows_exporter_security.receiver]
  labels                 = {
    instance = constants.hostname,
    job      = "integrations/windows_exporter",
  }
  xpath_query            = "*[System[(EventID=4660)]]"
}

loki.relabel "logs_integrations_windows_exporter_security" {

forward_to = [loki.process.logs_integrations_windows_exporter_security.receiver]

rule {

source_labels = ["computer"]

target_label  = "agent_hostname"

}

}


loki.process "logs_integrations_windows_exporter_security" {

forward_to = [loki.write.grafana_loki.receiver]

stage.json {

expressions = {

username   = "EventData.Data[?@.Name==‘SubjectUserName’].Value | [0]",

file       = "EventData.Data[?@.Name==‘ObjectName’].Value | [0]",

folder     = "EventData.Data[?@.Name==‘ObjectType’].Value | [0]",

hostname   = "System.Computer",

ip_address = "EventData.Data[?@.Name==‘IpAddress’].Value | [0]",

timestamp  = "System.TimeCreated.@SystemTime",

}

}

stage.labels {

values = {

username   = "",

file       = "",

folder     = "",

hostname   = "",

ip_address = "",

timestamp  = "",

}

}

}


loki.write "grafana_loki" {

endpoint {

url = "http://192.168.1.2:3100/loki/api/v1/push"

}

}

Key Changes:

  • Commas Added: Ensure that each key-value pair in maps and each item in lists is followed by a comma, except for the last item in a block.
  • Consistent Quotes: Ensure that single quotes are used consistently in JMESPath expressions.

Try this corrected configuration and see if it resolves the errors. If you encounter further issues, please let me know!

grot is still learning and improving, please let me know how I did by reacting below.

👍🏽 or 👎🏽

11

Which parts of this configuration wrong?

loki.source.windowsevent "logs_integrations_windows_exporter_security" {
  locale = 1033,
  eventlog_name = "Security",
  bookmark_path = "./bookmarks-security.xml",
  poll_interval = "0s",
  use_incoming_timestamp = true,
  forward_to = [loki.relabel.logs_integrations_windows_exporter_security.receiver],
  labels = {
    instance = constants.hostname,
    job = "integrations/windows_exporter",
  },
  xpath_query = "*[System[(EventID=4660)]]"
}

loki.relabel "logs_integrations_windows_exporter_security" {
  forward_to = [loki.process.logs_integrations_windows_exporter_security.receiver],
  rule {
    source_labels = ["computer"],
    target_label = "agent_hostname",
  }
}

loki.process "logs_integrations_windows_exporter_security" {
  forward_to = [loki.write.grafana_loki.receiver],
  stage.json {
    expressions = {
      username = "EventData.Data[?@.Name=='SubjectUserName'].Value | [0]",
      file = "EventData.Data[?@.Name=='ObjectName'].Value | [0]",
      folder = "EventData.Data[?@.Name=='ObjectType'].Value | [0]",
      hostname = "System.Computer",
      ip_address = "EventData.Data[?@.Name=='IpAddress'].Value | [0]",
      timestamp = "System.TimeCreated.@SystemTime",
    },
  },
  stage.labels {
    values = {
      username = "",
      file = "",
      folder = "",
      hostname = "",
      ip_address = "",
      timestamp = "",
    },
  }
}

loki.write "grafana_loki" {
  endpoint {
    url = "http://192.168.1.2:3100/loki/api/v1/push"
  }
}
12

It looks like the configuration you provided is mostly correct, but there are a few syntax issues that need to be addressed. Here are the corrections:

  1. Commas in HCL: In HCL (HashiCorp Configuration Language), which is used by Grafana Alloy, commas are not used to separate key-value pairs within blocks. Remove the commas after each key-value pair.

  2. Consistent Quotes: Ensure that single quotes are used consistently in JMESPath expressions.

Here's the corrected configuration:

loki.source.windowsevent "logs_integrations_windows_exporter_security" {
  locale                 = 1033
  eventlog_name          = "Security"
  bookmark_path          = "./bookmarks-security.xml"
  poll_interval          = "0s"
  use_incoming_timestamp = true
  forward_to             = [loki.relabel.logs_integrations_windows_exporter_security.receiver]
  labels = {
    instance = constants.hostname
    job      = "integrations/windows_exporter"
  }
  xpath_query = "*[System[(EventID=4660)]]"
}

loki.relabel "logs_integrations_windows_exporter_security" {

forward_to = [loki.process.logs_integrations_windows_exporter_security.receiver]

rule {

source_labels = ["computer"]

target_label  = "agent_hostname"

}

}


loki.process "logs_integrations_windows_exporter_security" {

forward_to = [loki.write.grafana_loki.receiver]

stage.json {

expressions = {

username   = "EventData.Data[?@.Name==‘SubjectUserName’].Value | [0]"

file       = "EventData.Data[?@.Name==‘ObjectName’].Value | [0]"

folder     = "EventData.Data[?@.Name==‘ObjectType’].Value | [0]"

hostname   = "System.Computer"

ip_address = "EventData.Data[?@.Name==‘IpAddress’].Value | [0]"

timestamp  = "System.TimeCreated.@SystemTime"

}

}

stage.labels {

values = {

username   = ""

file       = ""

folder     = ""

hostname   = ""

ip_address = ""

timestamp  = ""

}

}

}


loki.write "grafana_loki" {

endpoint {

url = "http://192.168.1.2:3100/loki/api/v1/push"

}

}

Key Changes:

  • Removed Commas: Removed commas after each key-value pair in the configuration blocks.
  • Consistent Quotes: Ensured that single quotes are used consistently in JMESPath expressions.

Try this corrected configuration and see if it resolves the errors. If you encounter further issues, please let me know!

grot is still learning and improving, please let me know how I did by reacting below.

👍🏽 or 👎🏽

14

It seems like you're on the right track with setting up Grafana Alloy to send Windows Event Logs to Loki. Here are a few additional tips and clarifications to ensure your configuration is correct:

  1. Configuration Syntax: Ensure that your configuration file is free of syntax errors. In HCL, commas are not used to separate key-value pairs within blocks, so make sure they are removed as needed.

  2. JMESPath Expressions: Double-check your JMESPath expressions to ensure they match the structure of your Windows Event Logs. You can use tools like JMESPath Terminal to test and validate your expressions against sample JSON data.

  3. Quotes: Ensure that you are using single quotes consistently in your JMESPath expressions. This is crucial for the expressions to be parsed correctly.

  4. Network and Permissions: Verify that the Windows machine running Grafana Alloy can communicate with the Loki server at 192.168.1.2:3100. Also, ensure that the user account running Grafana Alloy has the necessary permissions to access the Windows Event Logs.

  5. Testing and Verification: After setting up, test the configuration by checking the Loki server for incoming logs. Use Grafana to visualize and confirm that the logs are being received correctly.

If you encounter any further issues or have specific questions about the configuration, feel free to ask for more assistance. Good luck with your setup!

grot is still learning and improving, please let me know how I did by reacting below.

👍🏽 or 👎🏽