# Configure winlogbeat to send logs to cluster

**URL:** <https://discuss.elastic.co/t/configure-winlogbeat-to-send-logs-to-cluster/183945>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 3, 2019, 11:36am UTC](https://discuss.elastic.co/t/configure-winlogbeat-to-send-logs-to-cluster/183945 "2019-06-03T11:36:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\
**Post date:** [June 3, 2019, 11:36am UTC](https://discuss.elastic.co/t/configure-winlogbeat-to-send-logs-to-cluster/183945/1 "2019-06-03T11:36:36Z")

</div>

Hello,  
recently I have installed in my lab cluster ELK 7. Now I'd like to send events from Windows to ELK. How properly should I configure winlogbeat?

```auto
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["10.0.0.1:9200","10.0.0.2:9200"]

```

Is it proper configuration?

---

<div class="post-metadata">

**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\
**Post date:** [June 3, 2019, 12:37pm UTC](https://discuss.elastic.co/t/configure-winlogbeat-to-send-logs-to-cluster/183945/2 "2019-06-03T12:37:03Z")

</div>

hi @zen.xen, there are multiple configuration options here, I strongly suggest having a look at [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-configuration.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-configuration.html) and [https://www.elastic.co/guide/en/beats/winlogbeat/current/elasticsearch-output.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/elasticsearch-output.html) on the configuration steps and the basic winlogbeat.yml sample.

For example, in the winlogbeat.event\_logs section, you will have to specify the event logs you want to monitor. It seems that at least one event log must be configured as part of event\_logs. Example below:

```auto
winlogbeat.event_logs:
  - name: Application
  - name: Security
  - name: System

```

You might want to add some logging configuration as well, or if elasticsearch is secured, username and password should be added, etc.  
If you encounter any issues while configuring winlogbeat, please provide us with the content of the winlogbeat.yml file and the exception/stack trace.

---

<div class="post-metadata">

**Author:** ![zen.xen](https://avatars.discourse-cdn.com/v4/letter/z/e495f1/32.png) [@zen.xen](https://discuss.elastic.co/u/zen.xen)\
**Post date:** [June 3, 2019, 1:56pm UTC](https://discuss.elastic.co/t/configure-winlogbeat-to-send-logs-to-cluster/183945/3 "2019-06-03T13:56:52Z")

</div>

Hi,  
I configured options in winlogbeat, it works, but like I mentioned in my previous post, I have 2-node cluster, node-01: 10.0.0.1 and node-02: 10.0.0.2, the section output looks like this:

```auto
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["10.0.0.1:9200","10.0.0.2:9200"]

```

is it correct?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2019, 1:56pm UTC](https://discuss.elastic.co/t/configure-winlogbeat-to-send-logs-to-cluster/183945/4 "2019-07-01T13:56:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.