# 1 WEF and 2 separate outputs in winlogbeats

**URL:** <https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 30, 2018, 2:20pm UTC](https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035 "2018-04-30T14:20:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [April 30, 2018, 2:20pm UTC](https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035/1 "2018-04-30T14:20:34Z")

</div>

Is it possible to set up one windows event forwarder with 2 outputs?

I have our production WEF running great but in addition to this I want to use the same WEF to set up a test box for @Cyb3rWard0g 's @THE\_HELK and send the data out to it as well. Is this possible? I'd like to see the same production data going into both?

In other words, I want to use one WEF and push the data to 2 totally separate instances -  
regular ELKstack and @Cyb3rWard0g 's @THE\_HELK.

Thanks!

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [April 30, 2018, 2:29pm UTC](https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035/2 "2018-04-30T14:29:31Z")

</div>

Beats don't support multiple outputs, but if you are sending events from winlogbeat to logstash then you can add an additional output to logstash that sends the events to your HELK in addition to elasticsearch.

---

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [April 30, 2018, 3:05pm UTC](https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035/3 "2018-04-30T15:05:32Z")

</div>

Genius, that's why I come here! Thanks Jaime.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 28, 2018, 3:05pm UTC](https://discuss.elastic.co/t/1-wef-and-2-separate-outputs-in-winlogbeats/130035/4 "2018-05-28T15:05:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.