Logstash configuration tips for Windows – installation

March 20, 2014, with 4 comments
by admin

Ever since I discovered Logstash, I really admire what the guys at elasticsearch invented – how easy it is to use and how actually simple the application is in its core.

This post will give some hints on how to run Logstash under Windows, supporting log4net.
The post collects a number of sources and will hopefully allow you to set up Logstash successfully in your environment, too.

Event logs

Logstash 1.40 is unfortunately not coming with the eventlog gem installed per default any more.
I discovered this post describing a similar issue:


so all you have to do is:

  1. Get JRuby and add its bin directory to your path
  2. Set GEM_HOME to the vendor/bundle/jruby/1.9 directory within your logstash installation
  3. Clear GEM_PATH (“”)
  4. gem install win32ole
  5. Check that vendor\bundle\jruby\1.9\gems directory within your logstash installation contains the jruby-win32ole directory
  6. Finished

Now you can use eventlog as your input:

input {
  eventlog {
    type => 'Win32-EventLog'
    logfile => 'System'

Next posts on Logstash:

Aktualisiert am August 22, 2014

Keine Kommentare

  1. Sweet! I look forward to your log4net configuration follow-up.

    • Hi Rob,

      thanks for the feedback. This motivated me for the next posts that I promised before 🙂
      Looking forward to your feedback for the two new articles!



  2. Little bit more elaboration of the steps i.e. what you are doing and why would have helped. I am not getting enough clarify of whether you are running these commands on Linux / Windows.

    • I guess reading the title of the page helps to see that the configuration tips are for Windows. What additional information are you missing in the article?

Schreibe einen Kommentar

Kommentar absenden >>