Error when installing the fluent-plugin-windows-eventlog plugin

[peredoc]

Describe the bug

Greetings! When running the fluent-gem install fluent-plugin-windows-eventlog command, I'm getting an error message.

To Reproduce

sudo fluent-gem install fluent-plugin-windows-eventlog

Expected behavior

Installation of the fluent-plugin-windows-eventlog plugin

Your Environment

- Fluentd version: 1.16.7
- Package version: 5.0.6
- Operating system: Ubuntu 22.04.5
- Kernel version: 5.15.0-135-generic

Your Configuration

No changes have been made to the conf file yet

####
## Output descriptions:
##


# Treasure Data (http://www.treasure-data.com/) provides cloud based data
# analytics platform, which easily stores and processes data from td-agent.
# FREE plan is also provided.
# @see http://docs.fluentd.org/articles/http-to-td
#
# This section matches events whose tag is td.DATABASE.TABLE
<match td.*.*>
  @type tdlog
  @id output_td
  apikey YOUR_API_KEY

  auto_create_table
  <buffer>
    @type file
    path /var/log/fluent/buffer/td
  </buffer>

  <secondary>
    @type secondary_file
    directory /var/log/fluent/failed_records
  </secondary>
</match>

## match tag=debug.** and dump to console
<match debug.**>
  @type stdout
  @id output_stdout
</match>

####
## Source descriptions:
##

## built-in TCP input
## @see http://docs.fluentd.org/articles/in_forward
<source>
  @type forward
  @id input_forward
</source>

## built-in UNIX socket input
#<source>
#  type unix
#</source>

# HTTP input
# POST http://localhost:8888/<tag>?json=<json>
# POST http://localhost:8888/td.myapp.login?json={"user"%3A"me"}
# @see http://docs.fluentd.org/articles/in_http
<source>
  @type http
  @id input_http
  port 8888
</source>

## live debugging agent
<source>
  @type debug_agent
  @id input_debug_agent
  bind 127.0.0.1
  port 24230
</source>

####
## Examples:
##

## File input
## read apache logs continuously and tags td.apache.access
#<source>
#  @type tail
#  @id input_tail
#  <parse>
#    @type apache2
#  </parse>
#  path /var/log/httpd-access.log
#  tag td.apache.access
#</source>

## File output
## match tag=local.** and write to file
#<match local.**>
#  @type file
#  @id output_file
#  path /var/log/fluent/access
#</match>

## Forwarding
## match tag=system.** and forward to another fluentd server
#<match system.**>
#  @type forward
#  @id output_system_forward
#
#  <server>
#    host 192.168.0.11
#  </server>
#  # secondary host is optional
#  <secondary>
#    <server>
#      host 192.168.0.12
#    </server>
#  </secondary>
#</match>

## Multiple output
## match tag=td.*.* and output to Treasure Data AND file
#<match td.*.*>
#  @type copy
#  @id output_copy
#  <store>
#    @type tdlog
#    apikey API_KEY
#    auto_create_table
#    <buffer>
#      @type file
#      path /var/log/fluent/buffer/td
#    </buffer>
#  </store>
#  <store>
#    @type file
#    path /var/log/fluent/td-%Y-%m-%d/%H.log
#  </store>
#</match>

Your Error Log

xxx@xxx:~$ sudo fluent-gem install fluent-plugin-windows-eventlog
Building native extensions. This could take a while...
ERROR:  Error installing fluent-plugin-windows-eventlog:
        ERROR: Failed to build gem native extension.

    current directory: /opt/fluent/lib/ruby/gems/3.2.0/gems/winevt_c-0.11.1/ext/winevt
/opt/fluent/bin/ruby extconf.rb
checking for -lwevtapi... no
checking for EvtQuery() in winevt.h... no
checking for -ladvapi32... no
checking for -lole32... no
checking for RB_ALLOCV... yes
creating Makefile

current directory: /opt/fluent/lib/ruby/gems/3.2.0/gems/winevt_c-0.11.1/ext/winevt
make DESTDIR\= sitearchdir\=./.gem.20250411-21734-a6zlc9 sitelibdir\=./.gem.20250411-21734-a6zlc9 clean

current directory: /opt/fluent/lib/ruby/gems/3.2.0/gems/winevt_c-0.11.1/ext/winevt
make DESTDIR\= sitearchdir\=./.gem.20250411-21734-a6zlc9 sitelibdir\=./.gem.20250411-21734-a6zlc9
compiling winevt.c
In file included from winevt.c:1:
./winevt_c.h:8:10: fatal error: w32api.h: No such file or directory
    8 | #include <w32api.h>
      |          ^~~~~~~~~~
compilation terminated.
make: *** [Makefile:248: winevt.o] Error 1

make failed, exit code 2

Gem files will remain installed in /opt/fluent/lib/ruby/gems/3.2.0/gems/winevt_c-0.11.1 for inspection.
Results logged to /opt/fluent/lib/ruby/gems/3.2.0/extensions/x86_64-linux/3.2.0/winevt_c-0.11.1/gem_make.out

Additional context

No response

[peredoc]

I appreciate it!

[Watson1978]

fluent-plugin-windows-eventlog has only supported Windows platform. sorry.

[daipom]

Please run another Fluentd as Forwarder on Windows and forward the data to the aggregator Fluentd.

[peredoc]

Thanks for the info! @daipom @Watson1978 To confirm, do I need to have this plugin configured in the aggregator in order to ingest the winlogs from the fluentd forwarder?

[daipom]

No. You don't need to configure fluent-plugin-windows-eventlog in the aggregator.

Example:

Forwarder (Windows)

<source>
  @type windows_eventlog2
  @id windows_eventlog2_system
  tag test.win
  channels System
  parse_description
  <storage>
    path C:/opt/fluent/pos/system
  </storage>
</source>

<match test.**>
  @type forward
  @id forward
  require_ack_response
  <server>
    host foo
  </server>
</match>

Aggregator

<source>
  @type forward
  @id forward
</source>

<match test.**>
  @type stdout
  @id stdout
</match>