What is the solution for the normal display of histories of RDP connections win 2012 r2?

Question

RDP

Good evening everyone, I organized an RDP connection Remote App
, now you need to monitor the chronology of the connection history in a more normal version of the type with a sign like:
1. date connection time
2. IP connection address
3. Local and remote user
4. disconnection time (well, other information on connections everything is very confusing in one table
in the System Event Viewer, I would like it to be simpler and prettier in the table and then organize the sending of a daily list of connections to the mail for a day or a week. Please tell me there are such solutions. OS Windows Server 2012 R2. (maybe there is a solution that pulls from the system event viewer and forms it into a beautiful table)

Answer 1

https://gallery.technet.microsoft.com/scriptcenter...
Connection Report for Remote Desktop (RDPConnectionParser.ps1)

Answer 2

There are such solutions, but mega-paid ones. Netwrix, AD-Audit, etc.
You can write a script to write to a file on a specific event.
In the log, click on the desired event, add it to the scheduler, push your script into the scheduler for this event, writing the necessary data from the event in the log to the file. I hope it is clear in general terms where to dig.

Answer 3

The system event viewer is very confusing

Set up a current log filter. Or create a custom view.

Answer 4

Elk stack + filebeat

Answer 5

And another question: what data about the user can be obtained in the log or somewhere else besides the local user and the ip address of the remote PC?