# Elastic Endpoint shipping application and service logs

**URL:** <https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693>\
**Category:** Endpoint Security\
**Created:** [February 18, 2021, 10:58am UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693 "2021-02-18T10:58:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [February 18, 2021, 10:58am UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693/1 "2021-02-18T10:58:28Z")

</div>

Hi All,

Currently I can not see a way to configure the endpoint agent to collect logs from sub categories of "Applications and Services". Is this something I am missing or a feature that will come in the future ?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [February 18, 2021, 2:23pm UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693/2 "2021-02-18T14:23:03Z")

</div>

Do you mean for Endpoint to only collect events from some processes?

---

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [February 18, 2021, 2:35pm UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693/3 "2021-02-18T14:35:00Z")

</div>

I guess more applications than single processes, although that could be what you were suggesting.  
For example if i wanted to collect logs for windows defender I would have to ship;

Application and Service Logs \> Microsoft \> Windows \> Windows Defender

I know you already ship Sysmon logs from the same location as above, but could not see a clear way to ship others using the endpoint agent.

---

<div class="post-metadata">

**Author:** ![bradenpreston](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradenpreston/32/56729_2.png) [@bradenpreston](https://discuss.elastic.co/u/bradenpreston)\
**Post date:** [February 18, 2021, 9:04pm UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693/4 "2021-02-18T21:04:57Z")

</div>

Hi @The1WhoPrtNocks,

The endpoint integration for elastic agent does not collect specific application logs. However, you maybe be able to use our custom log integration to specify the log path.

You can add the integration to your agent via fleet. Will that work for your needs?

 ![Screen Shot 2021-02-18 at 4.03.27 PM](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a7d8701ed9a6f6c5f5f41432bbef6a165297f34.png)

 ![Screen Shot 2021-02-18 at 3.58.56 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/b/0b08d21f7abf7dbede12863e0226a56e9e3bf788.png)

---

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [February 19, 2021, 9:51am UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693/5 "2021-02-19T09:51:58Z")

</div>

Hi @bradenpreston ,

That is exactly what I needed, I am sorry for being that person who raises a question without clearly looking deep enough 🙂 .

---

<div class="post-metadata">

**Author:** ![bradenpreston](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradenpreston/32/56729_2.png) [@bradenpreston](https://discuss.elastic.co/u/bradenpreston)\
**Post date:** [February 19, 2021, 3:32pm UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693/6 "2021-02-19T15:32:40Z")

</div>

Not a problem at all. Please let us know if it works out for you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2021, 3:33pm UTC](https://discuss.elastic.co/t/elastic-endpoint-shipping-application-and-service-logs/264693/7 "2021-03-19T15:33:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.