# Does Winlogbeat work with the Semantic Logging Application Block (SLAB)?

**URL:** <https://discuss.elastic.co/t/does-winlogbeat-work-with-the-semantic-logging-application-block-slab/47524>\
**Category:** Beats\
**Created:** [April 15, 2016, 4:51pm UTC](https://discuss.elastic.co/t/does-winlogbeat-work-with-the-semantic-logging-application-block-slab/47524 "2016-04-15T16:51:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tlv324](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@tlv324](https://discuss.elastic.co/u/tlv324)\
**Post date:** [April 15, 2016, 4:51pm UTC](https://discuss.elastic.co/t/does-winlogbeat-work-with-the-semantic-logging-application-block-slab/47524/1 "2016-04-15T16:51:32Z")

</div>

I am currently using a shipper than works with SLAB, but has an issue with Shield Authentication. If Winlogbeat works with SLAB, I would be able to switch to that and make my shipping experience much easier!

Thanks in advance

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 16, 2016, 8:29pm UTC](https://discuss.elastic.co/t/does-winlogbeat-work-with-the-semantic-logging-application-block-slab/47524/2 "2016-04-16T20:29:19Z")

</div>

What is SLAB?

---

<div class="post-metadata">

**Author:** ![tlv324](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@tlv324](https://discuss.elastic.co/u/tlv324)\
**Post date:** [April 18, 2016, 1:13pm UTC](https://discuss.elastic.co/t/does-winlogbeat-work-with-the-semantic-logging-application-block-slab/47524/3 "2016-04-18T13:13:12Z")

</div>

> [@warkolm](#):
>
> What is SLAB?

As the title states SLAB is Semantic Logging Application Block, it is a framework in Windows that allows you to capture and manipulate events raised by applications. It uses .NET 4.5 and Event Tracing for Windows (ETW). ETW is an extendable logging system built into the Windows OS.

[Semantic Logging Application Documentation](https://msdn.microsoft.com/en-us/library/dn775006.aspx)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 18, 2016, 1:44pm UTC](https://discuss.elastic.co/t/does-winlogbeat-work-with-the-semantic-logging-application-block-slab/47524/4 "2016-04-18T13:44:29Z")

</div>

Winlogbeat does not read from ETW. This is the first request for the feature I have heard. It would be good for you to open a [enhancement request](https://github.com/elastic/beats/issues/new) in the project for ETW and explain that you want to read SLAB.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/does-winlogbeat-work-with-the-semantic-logging-application-block-slab/47524/5 "2017-07-05T21:53:07Z")

</div>


