Logtail allows you to configure plug-ins to collect Windows event logs. This topic describes how to configure Logtail in the Log Service console to collect Windows event logs.
Prerequisites
Implementation
The Windows Event Log API and Event Logging API are provided in Windows operating systems to record event logs. The Event Logging API is an upgrade of the Windows Event Log API, and is provided only in the Windows Vista operating system or later. Logtail plug-ins automatically select an API based on the operating system to obtain Windows event logs. Windows Event Log is preferred.
The publish-subscribe model is used to collect Windows event logs, as shown in the following figure. An application or kernel publishes event logs to a specified channel, such as an application, security, or system channel. Logtail uses the corresponding plug-in to call the Windows Event Log API or Event Logging API to subscribe to these channels. This way, Logtail continuously collects event logs and sends the logs to Log Service.
Logtail allows you to collect logs from multiple channels at the same time. For example, you can collect logs from the application channel and system channel.

View channel information
You can view the information of channels in the Event Viewer of a Windows server.
Procedure
What to do next

Parameter | Type | Filtered | Description |
---|---|---|---|
activity_id | string | Yes | The global transaction ID (GTID) of the event. Events that belong to the same transaction have the same GTID. |
computer_name | string | No | The name of the server where the event occurs. |
event_data | JSON object | No | The data related to the event. |
event_id | int | No | The ID of the event. |
kernel_time | int | Yes | The kernel time that is consumed by the event. In most cases, the value is 0. |
keywords | JSON array | Yes | The keyword that is associated with the event. Keywords are used to classify events. |
level | string | Yes | The severity level of the event. |
log_name | string | No | The name of the channel from which the event is obtained. The value of this parameter is the same as the value of the Name parameter that is specified in the Logtail plug-in configurations. |
message | string | Yes | The message that is associated with the event. |
message_error | string | Yes | The error that occurs when the message associated with the event is parsed. |
opcode | string | Yes | The operation code that is associated with the event. |
process_id | int | Yes | The process ID of the event. |
processor_id | int | Yes | The ID of the processor that is associated with the event. In most cases, the value is 0. |
processor_time | int | Yes | The processor time that is consumed by the event. In most cases, the value is 0. |
provider_guid | string | Yes | The GTID of the event source. |
record_number | int | No | The record number that is associated with the event. The record number increases when an event is written to Log Service. If the number exceeds 2 32 (Event Logging) or 2 64 (Windows Event Log), the record number starts from 0 again. |
related_activity_id | string | Yes | The GTID of another transaction that is associated with the transaction to which the event belongs. |
session_id | int | Yes | The session ID of the event. In most cases, the value is 0. |
source_name | string | No | The source of the event. The value of this parameter is the same as the value of the Provider parameter that is specified in the Logtail configurations. |
task | string | Yes | The task that is associated with the event. |
thread_id | int | Yes | The thread ID of the event. |
type | string | No | The API that is used to obtain the event. |
user_data | JSON object | No | The user data that is associated with the event. |
user_domain | string | Yes | The user domain that is associated with the event. |
user_identifier | string | Yes | The Windows Security Identifier (SID) of the user that is associated with the event. |
user_name | string | Yes | The username that is associated with the event. |
user_time | int | Yes | The user time that is consumed by the event. In most cases, the value is 0. |
user_type | string | Yes | The user type that is associated with the event. |
version | int | Yes | The version of the event. |
xml | string | Yes | The original information of the event in the XML format. |