tencent cloud

Cloud Log Service

DocumentationCloud Log ServicePractical TutorialLog CollectionCollecting Windows Environment Logs to CLS

Collecting Windows Environment Logs to CLS

Download
Focus Mode
Font Size
Last updated: 2026-06-09 10:17:15

Scenarios

This guide shows you how to collect Windows environment logs and upload them to CLS using Winlogbeat or Filebeat.

Prerequisites

You have activated CLS and created the required resources, such as logsets and Log topics.
You have obtained the SecretId and SecretKey from the Tencent Cloud CAM console.

Operation Steps

Collecting Windows Event Logs Using LogListener for Windows

Collecting Windows File Logs Using Filebeat

Installing Filebeat

1. Go to the official website, select the corresponding version, and download the installation package.
2. Upload the installation package to the root directory of a drive on the target Windows host and extract it.
3. Open powershell as an administrator, cd to the directory of the extracted files, and run the following command to install Filebeat.
# Execute the installation script to install the filebeat service.
.\\install-service-filebeat.ps1

# Install the template files
.\\filebeat.exe setup -e

# Start the filebeat service
start-service filebeat

Uploading Logs to CLS

In the Filebeat installation directory, locate the filebeat.reference.yml file, copy it, and rename it to filebeat.yml. Open filebeat.yml and modify the `output.kafka` section to the following content. This configuration directs Filebeat to send logs to the CLS Kafka producer endpoint.
output.kafka:
enabled: true
hosts: ["${region}-producer.cls.tencentyun.com:9095"] # TODO service address; public network port 9096, private network port 9095
topic: "${topicID}" # TODO topicID
version: "0.11.0.2"
compression: "${compress}" # Configures the compression method. Supported methods include gzip, snappy, and lz4, for example, "lz4".
username: "${logsetID}"
password: "${secret_id}#${secret_key}"
Parameter
Description
Authentication mechanism
Currently supports SASL_PLAINTEXT.
hosts
The CLS Kafka address. Configure it based on the region of the target log topic for writing. See Service Endpoint.
topic
The CLS Kafka topic name. Configure it as the log topic ID. For example: 76c63473-c496-466b-XXXX-XXXXXXXXXXXX.
username
The CLS Kafka access username. Configure it as the logset ID. For example: 0f8e4b82-8adb-47b1-XXXX-XXXXXXXXXXXX.
password
The CLS Kafka access password. The format is ${secret_id}#${secret_key}. For example: XXXXXXXXXXXXXX#YYYYYYYY. To obtain the key information, go to Key Acquisition.

Service Entry

Region
Network type
Port Number
Service Entry
Guangzhou
Private Network
9095
gz-producer.cls.tencentyun.com:9095
Public Network
9096
gz-producer.cls.tencentcs.com:9096
Note:
This document uses the Guangzhou region as an example. Public and private network domain names are distinguished by different ports. For other regions, replace the address prefix. For details, see Available Domain Names - Uploading Logs to Kafka.


Help and Support

Was this page helpful?

Help us improve! Rate your documentation experience in 5 mins.

Feedback