Event Log Forwarding

Event Log Forwarding ships the event logs collected from your managed devices – Windows Event Log entries, syslog, and application logs – to an external log store that the customer owns and controls. Breeze’s agents already gather these device logs; this feature additionally streams them outbound to the customer’s own SIEM or search cluster for long-term storage, search, and analysis. The destination can be any Elasticsearch- or OpenSearch-compatible store that accepts the standard bulk-ingest protocol, and forwarding can be configured per organization or applied partner-wide across every customer at once.

Not the same as Log Shipping

Event Log Forwarding is distinct from the agent diagnostic “Log Shipping” feature. Log Shipping sends the agent’s own internal diagnostic logs back to Breeze so you can troubleshoot the agent itself. Event Log Forwarding sends the customer’s managed-device event logs out to the customer’s own SIEM – never to Breeze. One answers “is the agent working?”; the other answers “what is happening on the customer’s machines?”.

---

Supported Destinations

Forwarding works with any log store that speaks the standard Elasticsearch/OpenSearch bulk-ingest wire protocol. The destinations named in the product are:

Destination	Notes
Elasticsearch	Official Elasticsearch clusters
OpenSearch	Self-managed OpenSearch
Wazuh indexer	The Wazuh SIEM indexer
AWS OpenSearch Service	Amazon-managed OpenSearch

Note

Any store that accepts the same bulk protocol will work. Generic HTTP/JSON, Splunk HEC, Datadog, and syslog targets are not supported today – those are planned for a future phase.

---

What You Configure

For a destination you set:

Setting	Description
Enable / disable	Forwarding only runs when turned on. When enabled, logs are forwarded on a recurring schedule (not real-time per event)
Log endpoint URL	The base URL of the compatible log store, e.g. https://logs.example.com:9200. Must use HTTPS – Breeze appends the bulk path itself
Index prefix	Defaults to breeze-logs. Logs land in date-stamped indices named <prefix>-YYYY.MM.DD (one per day)
Authentication	Either an API key or a username / password (basic auth)

Stored credentials are encrypted at rest and masked when the settings screen reloads. Outbound requests are also protected against being pointed at internal or private addresses.

Tip

Which categories of event logs are collected (and therefore forwarded) is governed separately under Configuration Policies, where you choose the categories – security, application, system, and hardware – along with a minimum severity, collection interval, and retention. The forwarding screen links you to Configuration Policies for those collection-side controls.

Which Application-log events are collected

Windows Application-log events at Error and Critical level are collected from every provider. Warning and Information Application events are collected only from the built-in providers, MsiInstaller (software install/uninstall) and APCPBEAgent (APC PowerChute Business Edition UPS events), plus providers listed in the device’s winning Event Logs configuration policy. Events that are not collected cannot be forwarded or matched by an event_log monitor.

Collect Warning and Information events from more Application providers

Use Configuration policy → Event Logs → Application providers to add up to 20 provider names. Use the exact name from Event Viewer’s Source column, or find registered providers on a Windows host with PowerShell:

Get-WinEvent -ListProvider *UPS*

Names must start with an ASCII letter or digit and may contain ASCII letters, digits, spaces, periods, underscores, dollar signs, parentheses and hyphens, up to 256 characters. Names are trimmed and duplicates are ignored regardless of case. For example, MSSQL$SQLEXPRESS is valid; .NET Runtime is not supported because it starts with a period. Quotes, brackets, slashes and other punctuation are not allowed.

Only the single winning Event Logs policy for each device applies; lists are not combined across policies. Scope the policy by assignment, for example to a device group containing machines that run your UPS software. Keep the Application category selected. The minimum severity still applies: choose Info to collect both Information and Warning, or Warning+ for Warning and higher. Selecting Error+ or Critical only filters out the lower levels even when their provider is listed.

A newly added provider is collected from the next collection pass onward, without a history back-fill. This requires agents released after this change; older agents ignore the provider list. Update agents before relying on these events for monitoring or forwarding.

For a UPS deployment, APC PowerChute’s APCPBEAgent provider is already built in, so it needs no additional entry. For a Dell UPS manager, read the registered provider name from a host where that software is installed; do not infer it from the product name. If the host reports Dell UPS Local Node Manager, add that exact name to the policy assigned to those machines, choose the minimum severity you need, and save. Subsequent matching events become available for monitors and forwarding.

---

Per-Organization Configuration

An organization administrator configures forwarding in Settings, in the Event Logs section (under Security & Access) for the currently selected organization. There you set the enable toggle, the endpoint URL, the index prefix, and authentication (API key or username and password). This points a single customer’s device logs at their own cluster.

1. Open Settings and select the Event Logs section (under Security & Access) for the organization.

2. Toggle forwarding on.

3. Enter the endpoint URL (HTTPS) and an index prefix (or keep the breeze-logs default).

4. Choose an authentication method and enter the API key or username and password.

5. Save. Confirm the categories you want collected are enabled in Configuration Policies.

---

Partner-Wide Configuration

At the partner level, a dedicated Event Logs tab lets the MSP configure forwarding once and apply it across all child organizations. The toggle is labeled Enable centralized event log shipping. When the partner enables it and fills in the endpoint URL, index prefix, and credentials, every child organization ships its event logs to that single configured destination.

How the two levels interact:

Partner setting	Effect on organizations
Disabled	Each organization configures its own destination individually. Partner fields show a “Not set – orgs configure individually” placeholder
Enabled and set	Becomes a managed, locked setting. The matching fields in the org-level screen are read-only with a “Managed by partner” label, and the system rejects org-level attempts to change locked fields

Note

Partner configuration is a true override, not just a default. When the partner locks a field, organizations cannot edit it. When the partner leaves forwarding disabled, organizations are free to self-serve their own destinations.

---

What Gets Shipped

Logs are sent in batches using the standard bulk-ingest format. Each forwarded event document contains:

Field	Description
timestamp	When the event occurred
hostname	The source device’s host name
device & organization identifiers	Which device and customer the event came from
category	security, application, system, or hardware
level	Severity: info, warning, error, or critical
source	The originating log source or provider
message	The event text
raw data	The original underlying event payload, when available

Each document is given a deterministic ID derived from its content, so re-sending a batch overwrites rather than duplicates – retries are safe and will not create duplicate entries in the destination. Batches hitting transient errors (rate limiting, server errors) are retried with backoff; permanent rejections (bad credentials, a malformed mapping) are dropped and reported rather than retried forever.

---

Fleet-Wide Log Search

Independently of forwarding to an external SIEM, Breeze also keeps managed-device event logs centrally and lets you search across multiple devices and organizations at once:

curl -X POST /api/v1/logs/search \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "patch installation failed",
    "timeRange": {
      "start": "2026-02-01T00:00:00Z",
      "end": "2026-02-28T23:59:59Z"
    },
    "level": ["error", "critical"],
    "category": ["system"],
    "deviceIds": ["UUID1", "UUID2"],
    "limit": 100,
    "sortBy": "timestamp",
    "sortOrder": "desc"
  }'

level accepts info, warning, error, critical; category accepts security, application, system, hardware – the same values as the event log fields above.

Additional Fleet Log Features

Feature	Endpoint	Description
Aggregation	GET /api/v1/logs/aggregation	Time-bucketed counts grouped by level, category, source, or device
Trends	GET /api/v1/logs/trends	Top error patterns and trending log sources
Correlation detection	POST /api/v1/logs/correlation/detect	Find patterns appearing across multiple devices
Correlation list	GET /api/v1/logs/correlation	List detected correlations with status
Saved queries	GET/POST/DELETE /api/v1/logs/queries	Save and reuse common search filters

Note

This searches Breeze’s own stored copy of the event logs, not the external SIEM destination – it works whether or not forwarding is enabled. For per-device diagnostic logs from the agent itself (not managed-device event logs), see Querying Diagnostic Logs in the Log Shipping docs.

---

Troubleshooting

No “test connection” button. There is no pre-save connection test. Save the configuration, then confirm logs are arriving by searching for the day’s index (<prefix>-YYYY.MM.DD) in your log store. Delivery failures are reported to operations through error tracking rather than shown at save time.

Logs are not arriving in the destination. Confirm forwarding is enabled, the endpoint URL is correct and uses HTTPS, and the credentials are valid. Confirm the relevant log categories are enabled in Configuration Policies – if nothing is being collected, nothing will be forwarded. Check that the endpoint is publicly reachable and is not an internal or private address, which is blocked.

An organization cannot change its forwarding settings. The partner has enabled centralized event log shipping and locked those fields. The org-level screen will show a “Managed by partner” label. Change the configuration at the partner level instead.

Logs are delayed. Forwarding runs on a recurring schedule, not in real time per event. A short delay between an event occurring on a device and it appearing in the destination is expected.

Am I sending agent diagnostics to my SIEM? No. Event Log Forwarding sends managed-device event logs only. The agent’s own diagnostic logs are handled separately by the Log Shipping feature and are sent to Breeze, not to your SIEM.