# Can filebeat push the Windows Event logs to logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 15, 2016, 7:55am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830 "2016-06-15T07:55:38Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![disalassalyjose](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@disalassalyjose](https://discuss.elastic.co/u/disalassalyjose)\ **Post date:** [June 15, 2016, 7:55am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/1 "2016-06-15T07:55:38Z")
Can we push Event logs from Windows server 2012 r2 to logststash which is installed on ubuntu using filebeat. Server : Ubuntu 14.04 Client : Windows server 2012 r2 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 15, 2016, 8:06am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/2 "2016-06-15T08:06:17Z")
Filebeat ships (text) files only, but look into Winlogbeat. ---
**Author:** ![disalassalyjose](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@disalassalyjose](https://discuss.elastic.co/u/disalassalyjose)\ **Post date:** [June 15, 2016, 8:19am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/3 "2016-06-15T08:19:52Z")
Hi Magnusbaek, Thaks for the prompt update.Will try with Winlogbeat and will get back If i get any errors. ---
**Author:** ![disalassalyjose](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@disalassalyjose](https://discuss.elastic.co/u/disalassalyjose)\ **Post date:** [June 20, 2016, 8:17am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/4 "2016-06-20T08:17:28Z")
Hi, I am not able to start the service in windows server 2012 r2 ,Getting 1053 error.Can you suggest me the correct settings that need to be done in the YAML. And also can you suggest me the logstash setting (fileter settings) that need to be done in the ubuntu server 14.04. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 20, 2016, 8:19pm UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/5 "2016-06-20T20:19:38Z")
Checkout the [documentation](https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-configuration.html) for getting started with Winlogbeat. Please make sure you run the step that says, "After you save your configuration file, test it with the following command." For Logstash usage with Beats, see [https://www.elastic.co/guide/en/beats/winlogbeat/master/config-winlogbeat-logstash.html](https://www.elastic.co/guide/en/beats/winlogbeat/master/config-winlogbeat-logstash.html) and [https://www.elastic.co/guide/en/beats/libbeat/master/logstash-installation.html#logstash-setup](https://www.elastic.co/guide/en/beats/libbeat/master/logstash-installation.html#logstash-setup). (You didn't mention a version, so be advised the links above are for Winlogbeat 5.X. You can choose documentation version using the drop-down on the right hand side of the pages). ---
**Author:** ![disalassalyjose](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@disalassalyjose](https://discuss.elastic.co/u/disalassalyjose)\ **Post date:** [June 22, 2016, 10:15am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/6 "2016-06-22T10:15:26Z")
I am able to push my event logs to logstash by using winlogbeat. Is this winlogbeat can be used to ship the text files like iis logs or is it only for shipping the event logs?. Can you suggest one beat which will ship all the logs like: event log,text files etc. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 22, 2016, 1:17pm UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/7 "2016-06-22T13:17:01Z")
Winlogbeat is for shipping Windows event logs. Filebeat is for shipping log files. You can run them both as Windows services side by side. Neither uses a lot of resources. ---
**Author:** ![disalassalyjose](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@disalassalyjose](https://discuss.elastic.co/u/disalassalyjose)\ **Post date:** [June 22, 2016, 3:59pm UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/8 "2016-06-22T15:59:01Z")
Is there any beat that can be used to ship iis log and event log instead of usign these both winlog beat and filebeat. if any please suggest. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 22, 2016, 6:12pm UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/9 "2016-06-22T18:12:35Z")
No, there is no Beats program that carries out both tasks. ---
**Author:** ![disalassalyjose](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@disalassalyjose](https://discuss.elastic.co/u/disalassalyjose)\ **Post date:** [June 23, 2016, 9:51am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/10 "2016-06-23T09:51:52Z")
Thanks @magnusbaeck ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2016, 7:56am UTC](https://discuss.elastic.co/t/can-filebeat-push-the-windows-event-logs-to-logstash/52830/11 "2016-07-06T07:56:06Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.