# Deploying Winlogbeat to collect event logs from a dev environment

**URL:** <https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 10, 2018, 3:00pm UTC](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378 "2018-07-10T15:00:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 10, 2018, 3:00pm UTC](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378/1 "2018-07-10T15:00:59Z")

</div>

Now that I have deployed winlogbeat to collect events from my event viewers, how can I go on about collecting events from my development environment?

Would it work something like this:  
Instead of installing winlogbeat locally, I would have to delete that and install winlogbeat on my dev environment? or can I install winlogbeat on my dev environment while keeping it on my host? wouldnt create repeated logs?

could someone shed some light onto this?

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [July 11, 2018, 12:06am UTC](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378/2 "2018-07-11T00:06:21Z")

</div>

Hi @Marcos_Felix,

You can send events from many locations. Everything coming from beats include some extra metadata you can use to filter it later on in Elasticsearch, for instance. you can use the `beat.hostname` field to differenciate production from dev.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 11, 2018, 8:58am UTC](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378/3 "2018-07-11T08:58:30Z")

</div>

I was thinking of installing winlogbeat in each of those environments, would that work or is that a bad way of doing it?

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [July 11, 2018, 10:45am UTC](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378/4 "2018-07-11T10:45:18Z")

</div>

That would work

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2018, 10:45am UTC](https://discuss.elastic.co/t/deploying-winlogbeat-to-collect-event-logs-from-a-dev-environment/139378/5 "2018-08-08T10:45:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.