# Build Winlobeat deb file

**URL:** <https://discuss.elastic.co/t/build-winlobeat-deb-file/225734>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 30, 2020, 7:03pm UTC](https://discuss.elastic.co/t/build-winlobeat-deb-file/225734 "2020-03-30T19:03:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![micas](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@micas](https://discuss.elastic.co/u/micas)\
**Post date:** [March 30, 2020, 7:03pm UTC](https://discuss.elastic.co/t/build-winlobeat-deb-file/225734/1 "2020-03-30T19:03:42Z")

</div>

I know the request is odd but i want to distribute winlogbeat inside a docker container that runs debian. I plan then (through configs and volumes) to read from the host windows machine.

Is there any way i can build a winlogbeat deb to distribute inside my docker container?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2020, 9:59pm UTC](https://discuss.elastic.co/t/build-winlobeat-deb-file/225734/2 "2020-03-30T21:59:35Z")

</div>

Winlogbeat is built for Windows only, so a deb doesn't really make sense.

---

<div class="post-metadata">

**Author:** ![micas](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@micas](https://discuss.elastic.co/u/micas)\
**Post date:** [March 30, 2020, 10:51pm UTC](https://discuss.elastic.co/t/build-winlobeat-deb-file/225734/3 "2020-03-30T22:51:32Z")

</div>

I understand, but if you check my use case above it would make sense. I want to bundle it on an existing docker container that already has other things and runs on debian.

Is it possible? I dont see why not since its all based on libbeat

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 30, 2020, 11:45pm UTC](https://discuss.elastic.co/t/build-winlobeat-deb-file/225734/4 "2020-03-30T23:45:01Z")

</div>

I get you, but winglogbeat needs to be installed on the host. It can't read a remote host from wherever it is installed, as it needs to pull from the local windows event log.

---

<div class="post-metadata">

**Author:** ![micas](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@micas](https://discuss.elastic.co/u/micas)\
**Post date:** [March 31, 2020, 5:28pm UTC](https://discuss.elastic.co/t/build-winlobeat-deb-file/225734/5 "2020-03-31T17:28:56Z")

</div>

Ok in that case i guess no way around. any plans of improving that in the future? all other beats can be ran dockerized just winlogbeat not... would be good to make it work on docker.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2020, 5:43pm UTC](https://discuss.elastic.co/t/build-winlobeat-deb-file/225734/6 "2020-04-28T17:43:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.