# EVTX Windows logs to ES

**URL:** <https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 21, 2020, 8:39am UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997 "2020-04-21T08:39:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![cyberzlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cyberzlo/32/65490_2.png) [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\
**Post date:** [April 21, 2020, 8:39am UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997/1 "2020-04-21T08:39:45Z")

</div>

Hi, what is most easy way to load static EVTX files to ES for forensics pourposes? Is there maybe some done setup for that? I just have dir with subdirectories for each system and in this subdirectories are evtx logs. Just want parse it and load to ES. Somehow I need distinguish logs between systems (are in different folders but EVTX file names are same for each system). Is it possible to automatic upload it with subdirectories?

---

<div class="post-metadata">

**Author:** ![cyberzlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cyberzlo/32/65490_2.png) [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\
**Post date:** [April 21, 2020, 9:10am UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997/2 "2020-04-21T09:10:14Z")

</div>

I found this [https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html)

Looks like `- name:` is designed to Windows log name, how should look this parameter for filename?

It is possible to upload logs from a lot of systems when logs are in different subdirectories for each system?

Eventually if there is no better way, I can do bash script in Linux subsystem to generate this lines with `- name:` but can you help me find best solution? Should I somehow use for example tags for distinguish each system etc? How should look example config?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 21, 2020, 12:09pm UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997/3 "2020-04-21T12:09:40Z")

</div>

If you need to do a batch load then I think scripting would be the way to go. Have a PowerShell script traverse the dirs and for each .evtx file found use the method described in the link above to invoke Winlogbeat to read the file.

The ingested events will include the full evtx file path and the logs themselves contain the original computer name from which they were sourced.

---

<div class="post-metadata">

**Author:** ![cyberzlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cyberzlo/32/65490_2.png) [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\
**Post date:** [April 21, 2020, 1:18pm UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997/4 "2020-04-21T13:18:40Z")

</div>

So config should looks like:

```auto
winlogbeat.event_logs:
  - name: C:\evtx\file1.evtx
    no_more_events: stop 
  - name: C:\evtx\file2.evtx
    no_more_events: stop 
  - name: C:\evtx\file3.evtx
    no_more_events: stop 

winlogbeat.shutdown_timeout: 30s 
winlogbeat.registry_file: evtx-registry.yml 

output.elasticsearch.hosts: ['http://localhost:9200']

```

yes? or `- name: 'C:\evtx\file1.evtx'`?

BTW, elasticsearch don't need to be on Windows, because it will be parsed by winlogbeat?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 23, 2020, 10:28pm UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997/5 "2020-04-23T22:28:12Z")

</div>

I would have the config setup to read one file at a time like shown in the docs.

Then make a wrapper script set `EVTX_FILE` each time it invokes Winlogbeat to read a new file. Then the script does something like this psuedo-code.

```auto
// foreach evtx_file in /my/dir/**/*.evtx
// do .\winlogbeat.exe -e -c .\winlogbeat-evtx.yml -E EVTX_FILE=$evtx_file

```

And correct, only Winlogbeat needs to be on Windows.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2020, 10:28pm UTC](https://discuss.elastic.co/t/evtx-windows-logs-to-es/228997/6 "2020-05-21T22:28:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.