Menu
Documentationbreadcrumb arrow Grafana Alloybreadcrumb arrow Referencebreadcrumb arrow Componentsbreadcrumb arrow lokibreadcrumb arrow loki.source.windowsevent
Open source

loki.source.windowsevent

loki.source.windowsevent reads events from Windows Event Logs and forwards them to other loki.* components.

You can specify multiple loki.source.windowsevent components by giving them different labels.

Usage

alloy 
loki.source.windowsevent "LABEL" {
  eventlog_name = EVENTLOG_NAME
  forward_to    = RECEIVER_LIST
}

Arguments

The component starts a reader and fans out log entries to the list of receivers passed in forward_to.

loki.source.windowsevent supports the following arguments:

NameTypeDescriptionDefaultRequired
localenumberLocale ID for event rendering. 0 default is Windows Locale.0no
eventlog_namestringEvent log to read from.See below.
xpath_querystringEvent log to read from."*"See below.
bookmark_pathstringKeeps position in event log."DATA_PATH/bookmark.xml"no
poll_intervaldurationHow often to poll the event log."3s"no
exclude_event_databoolExclude event data.falseno
exclude_user_databoolExclude user data.falseno
exclude_event_messageboolExclude the human-friendly event message.falseno
use_incoming_timestampboolWhen false, assigns the current timestamp to the log.falseno
forward_tolist(LogsReceiver)List of receivers to send log entries to.yes
labelsmap(string)The labels to associate with incoming logs.no

Note

eventlog_name is required if xpath_query doesn’t specify the event log. You can define xpath_query in short or XML form. When you use the XML form you can specify event_log in the xpath_query. If you use the short form, you must define eventlog_name.

Note

legacy_bookmark_path converts the legacy Grafana Agent Static bookmark to a Alloy bookmark, if bookmark_path doesn’t exist.

Component health

loki.source.windowsevent is only reported as unhealthy if given an invalid configuration.

Example

This example collects log entries from the Event Log specified in eventlog_name and forwards them to a loki.write component.

alloy 
loki.source.windowsevent "application"  {
    eventlog_name = "Application"
    forward_to = [loki.write.endpoint.receiver]
}

loki.write "endpoint" {
    endpoint {
        url ="loki:3100/api/v1/push"
    }
}

Compatible components

loki.source.windowsevent can accept arguments from the following components:

Note

Connecting some components may not be sensible or components may require further configuration to make the connection work correctly. Refer to the linked documentation for more details.