xWinlogbeat.schema.psm1
Configuration xWinlogbeat
{
    param (
        [string]$LocalPathDest = "$env:SystemDrive\Windows\temp\winlogbeat-1.3.1-windows.zip"
    )


    Import-DscResource -ModuleName xPSDesiredStateConfiguration
    Import-DscResource -ModuleName PSDesiredStateConfiguration

    xRemoteFile Downloader {
        Uri = "https://download.elastic.co/beats/winlogbeat/winlogbeat-1.3.1-windows.zip" 
        DestinationPath = $LocalPathDest
    }

    Archive ArchiveWinlogbeat {
        Ensure = "Present"  # You can also set Ensure to "Absent"
        Path = $LocalPathDest
        Destination = "$env:SystemDrive\Windows\temp"
    }

    File DirectoryWonlogbeat {
        Ensure = "Present"
        Type = "Directory"
        Recurse = $true
        Force = $true
        SourcePath = "$env:SystemDrive\Windows\temp\winlogbeat-1.3.1-windows"
        DestinationPath = "$env:SystemDrive\Program Files\winlogbeat"
    }

    File ConfigurationWinlogbeat {
        Ensure = 'Present'
        Type = 'File'
        DestinationPath = "$env:SystemDrive\Program Files\winlogbeat\winlogbeat.yml"
        Force = $true
        Contents = @"
winlogbeat:
  registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml
  event_logs:
    - name: Application
      ignore_older: 72h
    - name: Security
      ignore_older: 72h
    - name: System
      ignore_older: 72h
    - name: Microsoft-Windows-DSC/Operational

output:
  logstash:
    hosts: ["logstash.satin-pl.com:5044"]

shipper:

logging:
  to_files: true
  files:
    path: C:/ProgramData/winlogbeat/Logs
    rotateeverybytes: 10485760 # = 10MB
  level: warning
"@

    }

    Service ServiceWinlogbeat {
        Name            = "winlogbeat"
        StartupType     = "Automatic"
        Ensure          = "Present"
        Path            = "`"$env:SystemDrive\Program Files\winlogbeat\winlogbeat.exe`" -c `"$env:SystemDrive\Program Files\winlogbeat\winlogbeat.yml`""
        BuiltInAccount  = "LocalSystem"
        Description     = "Winlogbeat ships Windows event logs to Elasticsearch or Logstash."
        State           = "Running"
    } 


}
xWonlogbeat.psd1
#
# Module manifest for module 'xWinlogbeat'
#
# Generated by: plsatin
#
# Generated on: 08.11.2017
#

@{

    # Script module or binary module file associated with this manifest.
    RootModule = 'xWinlogbeat.schema.psm1'

    # Version number of this module.
    ModuleVersion = '0.0.4'

    # ID used to uniquely identify this module
    GUID = '4680cfc5-f138-475f-b533-07fdf921fbc5'

    # Author of this module
    Author = 'Pavel Satin'

    # Company or vendor of this module
    CompanyName = 'Pavel Satin'

    # Copyright statement for this module
    Copyright = '(c) 2017 Pavel Satin. All rights reserved.'

    # Description of the functionality provided by this module
    Description = 'Module for installing the Winlogbeat'

    # Minimum version of the Windows PowerShell engine required by this module
    # PowerShellVersion = ''

    # Name of the Windows PowerShell host required by this module
    # PowerShellHostName = ''

    # Minimum version of the Windows PowerShell host required by this module
    # PowerShellHostVersion = ''

    # Minimum version of Microsoft .NET Framework required by this module
    # DotNetFrameworkVersion = ''

    # Minimum version of the common language runtime (CLR) required by this module
    # CLRVersion = ''

    # Processor architecture (None, X86, Amd64) required by this module
    # ProcessorArchitecture = ''

    # Modules that must be imported into the global environment prior to importing this module
    # RequiredModules = @()

    # Assemblies that must be loaded prior to importing this module
    # RequiredAssemblies = @()

    # Script files (.ps1) that are run in the caller's environment prior to importing this module.
    # ScriptsToProcess = @()

    # Type files (.ps1xml) to be loaded when importing this module
    # TypesToProcess = @()

    # Format files (.ps1xml) to be loaded when importing this module
    # FormatsToProcess = @()

    # Modules to import as nested modules of the module specified in RootModule/ModuleToProcess
    # NestedModules = @()

    # Functions to export from this module
    FunctionsToExport = '*'

    # Cmdlets to export from this module
    CmdletsToExport = '*'

    # Variables to export from this module
    VariablesToExport = '*'

    # Aliases to export from this module
    AliasesToExport = '*'

    # List of all modules packaged with this module
    # ModuleList = @()

    # List of all files packaged with this module
    # FileList = @()

    # Private data to pass to the module specified in RootModule/ModuleToProcess
    # PrivateData = ''

    # HelpInfo URI of this module
    # HelpInfoURI = ''

    # Default prefix for commands exported from this module. Override the default prefix using Import-Module -Prefix.
    # DefaultCommandPrefix = ''

}