plWinlogbeat.psd1
@{

    # Script module or binary module file associated with this manifest.
    RootModule = 'plWinlogbeat.psm1'

    DscResourcesToExport = 'plWinlogbeat'

    # Version number of this module.
    ModuleVersion = '0.0.1'

    # ID used to uniquely identify this module
    GUID = '408a5d98-6852-4cd0-8636-76428f9bf2db'

    # Author of this module
    Author = 'Pavel Satin'

    # Company or vendor of this module
    CompanyName = 'Pavel Satin'

    # Copyright statement for this module
    Copyright = '(c) 2017 Pavel Satin. All rights reserved.'

    # Description of the functionality provided by this module
    # Description = ''

    # Minimum version of the Windows PowerShell engine required by this module
    PowerShellVersion = '5.0'

    # Name of the Windows PowerShell host required by this module
    # PowerShellHostName = ''
    }
plWinlogbeat.psm1
enum Ensure
{
    Absent
    Present
}

<#
   This resource manages the file in a specific path.
   [DscResource()] indicates the class is a DSC resource
#>

[DscResource()]
class plWinlogbeat
{
    <#
       This property is the fully qualified path to the file that is
       expected to be present or absent.

       The [DscProperty(Key)] attribute indicates the property is a
       key and its value uniquely identifies a resource instance.
       Defining this attribute also means the property is required
       and DSC will ensure a value is set before calling the resource.

       A DSC resource must define at least one key property.
    #>
    [DscProperty(Key)]
    [string]$PathWinlogbeat

    <#
        This property indicates if the settings should be present or absent
        on the system. For present, the resource ensures the file pointed
        to by $Path exists. For absent, it ensures the file point to by
        $Path does not exist.

        The [DscProperty(Mandatory)] attribute indicates the property is
        required and DSC will guarantee it is set.

        If Mandatory is not specified or if it is defined as
        Mandatory=$false, the value is not guaranteed to be set when DSC
        calls the resource.  This is appropriate for optional properties.
    #>
    [DscProperty(Mandatory)]
    [Ensure] $Ensure


    <#
        This method is equivalent of the Set-TargetResource script function.
        It sets the resource to the desired state.
    #>
    [void] Set()
    {
        $serviceExists = $this.TestWinlogbeat()
        if ($this.ensure -eq [Ensure]::Present) {
            if (-not $serviceExists)
            {
                $this.InstallWinlogbeat()
            }
        } else {
            if ($serviceExists) {
                Write-Verbose -Message "Deleting the service winlogbeat"
                if (Get-Service winlogbeat -ErrorAction SilentlyContinue) {
                    $service = Get-WmiObject -Class Win32_Service -Filter "name='winlogbeat'"
                    $service.StopService()
                    Start-Sleep -s 1
                    $service.delete()
                }
                Remove-Item "C:\Program Files\winlogbeat" -Force
            }
        }
    }

    <#
        This method is equivalent of the Test-TargetResource script function.
        It should return True or False, showing whether the resource
        is in a desired state.
    #>
    [bool] Test()
    {
        $present = $this.TestWinlogbeat()

        if ($this.Ensure -eq [Ensure]::Present) {
            return $present
        } else {
            return -not $present
        }
    }

    <#
        This method is equivalent of the Get-TargetResource script function.
        The implementation should use the keys to find appropriate resources.
        This method returns an instance of this class with the updated key
         properties.
    #>
    [plWinlogbeat] Get()
    {
        $present = $this.TestWinlogbeat()

        if ($present)
        {
            $this.Ensure = [Ensure]::Present
        } else {
            $this.Ensure = [Ensure]::Absent
        }

        return $this
    }

    [bool] TestWinlogbeat()
    {
        $present = $true

        if (Get-Service "winlogbeat" -ErrorAction SilentlyContinue) {
            Write-Verbose -Message "The service is present in the system"
            $present =  $true
        } else {
            Write-Verbose -Message "Service is not present in the system"
            $present =  $false
        }

        return $present
    }

    [void] InstallWinlogbeat()
    {

        $localDir = "c:\Windows\Temp"
        $localFile = "c:\Windows\Temp\winlogbeat-1.3.1-windows.zip"
        $PkgDir = "winlogbeat-1.3.1-windows"


$winlogbeat_yml = @"
winlogbeat:
  registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml
  event_logs:
    - name: Application
      ignore_older: 72h
    - name: Security
      ignore_older: 72h
    - name: System
      ignore_older: 72h
    - name: Microsoft-Windows-DSC/Operational


output:
  logstash:
    hosts: ["logstash.satin-pl.com:5044"]

shipper:

logging:
  to_files: false
  files:
    path: C:/ProgramData/winlogbeat/Logs
    rotateeverybytes: 10485760 # = 10MB
  level: warning
"@



        $PkgURL = "https://download.elastic.co/beats/winlogbeat/winlogbeat-1.3.1-windows.zip"
        $winlogbeatConf = "C:\Program Files\winlogbeat\winlogbeat.yml"


        try {
            Invoke-WebRequest $PkgURL -OutFile $localFile
        }
        catch [System.Exception] {
            $errorstr = $_.Exception.toString()
            Write-Verbose -Message $errorstr
        }

        if (Test-Path $localFile) {

            Expand-Archive -Path $localFile  -DestinationPath $localDir -Force

            #Remove-Item $localFile
            Move-Item "$localDir\$PkgDir" "C:\Program Files\winlogbeat"

        if (Get-Service winlogbeat -ErrorAction SilentlyContinue) {
            $service = Get-WmiObject -Class Win32_Service -Filter "name='winlogbeat'"
            $service.StopService()
            Start-Sleep -s 1
            $service.delete()
            }

            # create new service
            New-Service -name winlogbeat `
            -displayName winlogbeat `
            -binaryPathName "`"C:\Program Files\winlogbeat\winlogbeat.exe`" -c `"C:\Program Files\winlogbeat\winlogbeat.yml`""

            Set-Content -Encoding UTF8 -Path $winlogbeatConf -Value $winlogbeat_yml -Force

            Write-Verbose -Message "Starting the service ..."

            Start-Service winlogbeat

        } else {
            Write-Verbose -Message "Package failed to download!"
        }


  }
}

Ссылки