# Collecting Windows Logs from NAS/CIFS Sever
**URL:** https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728
**Category:** Beats
**Tags:** winlogbeat
**Created:** [March 29, 2016, 7:37pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728 "2016-03-29T19:37:37Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Jim\_Jepson](https://discuss.elastic.co/u/Jim_Jepson)
#### Post date: [March 29, 2016, 7:37pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/1 "2016-03-29T19:37:37Z")
We would like to pull windows logs from a remote computer -- actually it is a NAS/CIFS server running on an EMC storage server -- so no way to run winlogbeat locally.
From the event viewer on a windows computer I can connect to this "server" and see normal looking classic Windows event logs. Can winlogbeat be used to get these logs into ELK? If not, any ideas how to do this?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 29, 2016, 8:55pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/2 "2016-03-29T20:55:20Z")
Winlogbeat can't do remote logs sorry.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [March 29, 2016, 8:59pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/3 "2016-03-29T20:59:22Z")
If you can connect from Event Viewer on a remote machine, then you should be able to setup an [Event Subscription](https://technet.microsoft.com/en-us/library/4aa6403f-d4b8-43a4-a70d-ceb7f88c524e) where the remote computer pulls the events from the NAS into the `ForwardedEvents` log on the remote Windows machine. Then you setup Winlogbeat to monitor the `ForwardedEvents` log.
This feature is built into MS Vista and newer operating systems and is my preferred approach to collecting remote event logs.
[Create a New Subscription](https://technet.microsoft.com/en-us/library/cc722010)
---
### Author:  [@Jim\_Jepson](https://discuss.elastic.co/u/Jim_Jepson)
#### Post date: [March 29, 2016, 9:22pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/4 "2016-03-29T21:22:53Z")
Thanks! I'll give it a try.
---
### Author:  [@Jim\_Jepson](https://discuss.elastic.co/u/Jim_Jepson)
#### Post date: [March 30, 2016, 6:39pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/5 "2016-03-30T18:39:37Z")
Unfortunately I cannot create a subscription to this NAS server - no WinRM service.
One thing I found that could work is the MS [LogParser](https://technet.microsoft.com/en-us/scriptcenter/dd919274.aspx) to reach the logs and select out records to a CSV file. What are my options to get this into Logstash? Is there anyway I can utilize the new [winlogbeat eventlog record fields](https://www.elastic.co/guide/en/beats/winlogbeat/master/exported-fields-eventlog.html) to filter and format the log data? I do have some newbie experience with filebeat, if this is the way to do it.
Any other suggestions?
Thank you for your help.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 1, 2016, 11:08am UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/6 "2016-04-01T11:08:52Z")
> [@Jim\_Jepson](#):
>
> What are my options to get this into Logstash?
You could run Logstash on the same machine as the CSV file and use the [file input](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html) with a [CSV filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html).
> [@Jim\_Jepson](#):
>
> Is there anyway I can utilize the new winlogbeat eventlog record fields to filter and format the log data?
No, but based on this use case where you can't use the WinRM service, I will put remote event logs back on the [list of features](https://github.com/elastic/beats/issues/465#issuecomment-163352546) to consider adding.
---
### Author:  [@Jim\_Jepson](https://discuss.elastic.co/u/Jim_Jepson)
#### Post date: [April 1, 2016, 5:57pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/7 "2016-04-01T17:57:23Z")
Ok, thanks for the help. I will do this.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/collecting-windows-logs-from-nas-cifs-sever/45728/8 "2017-07-05T21:53:55Z")