w.yml

winlogbeat.event_logs:
  - name: Application
    ignore_older: 240m
  - name: Security
    ignore_older: 240m
  - name: System
    ignore_older: 240m
  - name: Microsoft-windows-sysmon/operational
    ignore_older: 240m
  - name: Microsoft-windows-PowerShell/Operational
    ignore_older: 240m
    event_id: 4103, 4104
  - name: Windows PowerShell
    event_id: 400,600
    ignore_older: 240m
  - name: Microsoft-Windows-WMI-Activity/Operational
    event_id: 5857,5858,5859,5860,5861

output.kafka:
  hosts: ["IPADDRESS:9092"]
  topic: "winlogbeat"
  max_retries: 2
  max_message_bytes: 1000000