Set-FluentdConfig.psm1
|
<#
.SYNOPSIS This downlaods, installs and configures a fluentd windows agent via td-agent to forward logs to a centeralized server. .PARAMETER Server The IP or FQDN of the fluentd server to forward the packets to. .PARAMETER Servername The hostname of the fluentd server to forward the packets to. .PARAMETER Port The port number of the server to specify (defaults to 443) .EXAMPLE Set-FluentdCconfig -Server logs.example.com -port 7777 #> function Set-FluentdConfig { [CmdletBinding()] param( [Parameter()] [string]$Server, [string]$Servername, [string]$Tag='winevt.raw', [int]$Port=443 ) $ConfigFileBasline = " #============================================================================== # FluentD (aka td-agent) - Azusa Pacific University #============================================================================== #-------------------------------------- # INPUT PLUGINS #-------------------------------------- <source> @type windows_eventlog2 @id windows_eventlog2 channels application,system,security read_existing_events false parse_description true read_interval 2 tag $Tag rate_limit 300 <storage> persistent true path C:\opt\td-agent\winevt.pos </storage> <subscribe> channels application,system,security read_existing_events false </subscribe> </source> #-------------------------------------- # FILTER PLUGIN #-------------------------------------- # This is used to ensure compatibility with elasticsearch and graylog. <filter **> @type record_transformer <record> message `${record[`"DescriptionTitle`"]} </record> </filter> #-------------------------------------- # OUTPUT PLUGINS #-------------------------------------- ## Forward to central fluent aggregator <match **> @type copy <store> @type stdout </store> <store> @type forward send_timeout 5s recover_wait 10s heartbeat_interval 1s phi_threshold 16 hard_timeout 60s <server> name $(if ($ServerName){$ServerName}else{$Server}) host $Server port $Port </server> <secondary> @type file path C:/opt/td-agent/forward-failed </secondary> <buffer> @type file path C:/opt/td-agent/fluent.general flush_interval 10s </buffer> </store> </match> " Out-File -Encoding utf8 -Force -FilePath "C:\opt\td-agent\etc\td-agent\td-agent.conf" -InputObject $ConfigFileBasline } |