For ELK and IIS

Here is result

For ELK system and windows event log

Here is result (this is kibana visualize count)

.

For Win event log

Turn on windows logon event log

Follow on

For ELK use, we need attach new datadisk

root@abc:/mnt# grep SCSI /var/log/syslog
Nov 21 12:36:37 localhost kernel: [333388.594976] sd 5:0:0:0: [sdc] Attached SCSI disk

root@abc:/mnt# fdisk /dev/sdc