LinkMesh

Search docs, blog and changelog

ENDE

Snippets · Sources

Collect Windows Event Log (Application, System, Security)

The windowseventlog receiver reads each channel through the Windows Event Log API and turns every event into a structured body: provider, event_id, level, computer, event_data and more. The rendered, human-readable text comes along twice - as message and again inside rendering_info - so this config deletes both and keeps the structured fields. On a freshly provisioned GitLab SaaS Windows Server runner, on the same 22,895 events from all three channels, that cut the body bytes by 36%. The Security channel needs the collector to run as LocalSystem or as a member of Event Log Readers.

Signals
Logs
Category
Collection
Source
Windows Event Log
Components
windowseventlogbatchmemory_limitertransformotlphttp
Destination
OTLP/HTTP endpoint

OpenTelemetry Collector

OpenTelemetry Collector YAML
receivers:
  windowseventlog/application:
    channel: Application
  windowseventlog/system:
    channel: System
  # Security needs the collector to run as LocalSystem or as a member of
  # Event Log Readers.
  windowseventlog/security:
    channel: Security

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
    spike_limit_percentage: 25
  # The rendered text is in the body twice: message and rendering_info.
  transform/drop-rendered:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          - delete_key(body, "message")
          - delete_key(body, "rendering_info")
  batch:
    timeout: 5s

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [windowseventlog/application, windowseventlog/system, windowseventlog/security]
      processors: [memory_limiter, transform/drop-rendered, batch]
      exporters: [otlphttp]

LinkMesh

Library › Sources › Windows Event Log

Channel
Application
Max Reads
100
Start At
end

What LinkMesh then pushes to the collector, under receivers:

Pushed to the collector
windowseventlog/input_src_00000501:
  channel: Application
  max_reads: 100
  start_at: end

The same, as an API call (see automation recipes):

API call
curl -X POST "$LINKMESH/sources" \
  -H "Authorization: Bearer $LMSAT" \
  -H "Content-Type: application/json" \
  -d '{
  "defaultConfig": {
    "channel": "Application",
    "max_reads": 100,
    "start_at": "end"
  },
  "name": "Windows Event Log",
  "receiverType": "windowseventlog"
}'

Library › Sources › Windows Event Log

Channel
System
Max Reads
100
Start At
end

What LinkMesh then pushes to the collector, under receivers:

Pushed to the collector
windowseventlog/input_src_00000501:
  channel: System
  max_reads: 100
  start_at: end

The same, as an API call (see automation recipes):

API call
curl -X POST "$LINKMESH/sources" \
  -H "Authorization: Bearer $LMSAT" \
  -H "Content-Type: application/json" \
  -d '{
  "defaultConfig": {
    "channel": "System",
    "max_reads": 100,
    "start_at": "end"
  },
  "name": "Windows Event Log",
  "receiverType": "windowseventlog"
}'

Library › Sources › Windows Event Log

Channel
Security
Max Reads
100
Start At
end

What LinkMesh then pushes to the collector, under receivers:

Pushed to the collector
windowseventlog/input_src_00000501:
  channel: Security
  max_reads: 100
  start_at: end

The same, as an API call (see automation recipes):

API call
curl -X POST "$LINKMESH/sources" \
  -H "Authorization: Bearer $LMSAT" \
  -H "Content-Type: application/json" \
  -d '{
  "defaultConfig": {
    "channel": "Security",
    "max_reads": 100,
    "start_at": "end"
  },
  "name": "Windows Event Log",
  "receiverType": "windowseventlog"
}'

The rest of the collector config above (memory_limiter, transform, batch, otlphttp) is not part of these templates: in LinkMesh those are separate sources, processors and destinations on the route.

Generated from LinkMesh's template catalogue by linkmesh-server snippet-render 1.464.3, not written by hand.

Download config.yamlValidated on Windows with otelcol-contrib v0.161.0 on 2026-10-26

Complete config files, each checked with the collector's own validate command (otelcol-contrib v0.161.0). Replace https://your-backend:4318 with your own OTLP endpoint before you run it.

The gotcha

Security can outnumber everything else by far. On our runner, read from the beginning, Security held 21,529 of 26,054 events, and a single event id - 4907, "auditing settings on object were changed", written while software was being installed - accounted for 17,960 of them. Look at your own Security volume before you send it all; dropping by event id works as in the reduced-events pipeline.

What it does not catch

No before/after table: the receiver exists only in the Windows build of the collector, and the behaviour harness runs on Linux. The figures above are from a measured run on a GitLab SaaS Windows runner; CI validates this config there on every change to it.

Manage this across a fleet

LinkMesh manages collector configuration across a fleet from one self-hosted control plane, so a change like this is made once rather than host by host. The first 25 Collectors are free after a no-card registration in the OpenSight Customer Portal (5 without one).

Install LinkMesh →See all snippets

Related snippets