promtail-windows/promtail-config.yaml

server:
  http_listen_port: 9080
  grpc_listen_port: 0

client:
  url: http://10.1.2.113:3100/api/prom/push

scrape_configs:
  - job_name: windows
    windows_events:
      eventlog_name: "Application"
      bookmark_path: "./bookmark.xml"
      xpath_query: "*"
      labels:
        job: windows
    pipeline_stages:
      - json:
          expressions:
            level: levelText
  - job_name: security
    windows_event:
      eventlog_name: "Security"
      bookmark_path: "./bookmark.xml"
      xpath_query: "*"
      labels:
        job: security
    pipeline_stages:
      - json:
          expressions:
            level: levelText