# Deleting source logs after shipping

**URL:** <https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 30, 2017, 9:27pm UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496 "2017-06-30T21:27:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![cdnnhicks](https://avatars.discourse-cdn.com/v4/letter/c/e495f1/32.png) [@cdnnhicks](https://discuss.elastic.co/u/cdnnhicks)\
**Post date:** [June 30, 2017, 9:27pm UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496/1 "2017-06-30T21:27:39Z")

</div>

Hi, First post here. I've just finished setting up my ELK stack and I've got a number of Windows servers forwarding their System, Application and Security logs. I'm looking to see if there's a way to delete the logs from my source servers after shipping them to my ELK stack. We have some old servers whose logs fill up and throw errors if they aren't cleared out.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 30, 2017, 11:11pm UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496/2 "2017-06-30T23:11:21Z")

</div>

This is not something that beats can do for you unfortunately.

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [July 1, 2017, 3:13am UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496/3 "2017-07-01T03:13:30Z")

</div>

You can configure this on your Windows servers. Go to Event Viewer and open the Properties of each log type, you should be able to overwrite old events or archive to local files.

---

<div class="post-metadata">

**Author:** ![cdnnhicks](https://avatars.discourse-cdn.com/v4/letter/c/e495f1/32.png) [@cdnnhicks](https://discuss.elastic.co/u/cdnnhicks)\
**Post date:** [July 5, 2017, 5:45pm UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496/4 "2017-07-05T17:45:55Z")

</div>

That's what I thought. Thanks for confirming.

---

<div class="post-metadata">

**Author:** ![cdnnhicks](https://avatars.discourse-cdn.com/v4/letter/c/e495f1/32.png) [@cdnnhicks](https://discuss.elastic.co/u/cdnnhicks)\
**Post date:** [July 5, 2017, 5:46pm UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496/5 "2017-07-05T17:46:21Z")

</div>

I knew about overwriting the logs, I was just curious if I could do it through beats. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2017, 5:46pm UTC](https://discuss.elastic.co/t/deleting-source-logs-after-shipping/91496/6 "2017-08-02T17:46:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.