What would you replace Logstash with on Windows?

Replacing Logstash on Windows can be achieved with the following solutions:

• Filebeat + Elasticsearch + Kibana (EFK): Filebeat is a lightweight agent for log collection, well integrated with Windows Event Logs and log files. Elasticsearch is a decentralized storage for indexing and analyzing logs. Kibana is a visualization and interactive analysis tool.
• Fluentd / Fluent Bit: Powerful and flexible data collectors with many plugins, including for Windows. Fluent Bit is a more lightweight option for limited resources.
• NXLog: A log collection agent developed specifically for Windows, supporting many sources and formats.
• Windows Event Forwarding (WEF): Built-in Windows mechanism for centralized collection of event logs from multiple computers. It can be used to collect logs with subsequent sending to other systems.
• OpenTelemetry Collector: A universal telemetry collector, including logs, supporting various protocols and exporters.

Each solution has its advantages and disadvantages depending on specific requirements: data volume, processing complexity, existing infrastructure, budget.

Criterion	Filebeat + EFK	Fluentd / Fluent Bit	NXLog	WEF	OpenTelemetry Collector
Lightweight	High (Filebeat)	Medium / High (Bit)	Medium	Built-in	Medium
Flexibility	Good (via Elasticsearch Pipeline)	Very high (plugins)	Good (modules)	Limited	High
Windows Integration	Good	Good	Excellent	Excellent	Good
Cost	Open Source	Open Source	Commercial / Open Source	Built-in (free)	Open Source
Configuration complexity	Medium	Medium / High	Medium / High	Medium	Medium

For log collection from the Windows file system, Filebeat is one of the most popular and easiest to configure options.

Example Filebeat configuration for log collection from a file:

# filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - C:\path\to\your\logs\*.log

output.elasticsearch:
  hosts: ["localhost:9200"]