# Filebeat and Windows Eventlog

**URL:** <https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 26, 2015, 8:51am UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643 "2015-11-26T08:51:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![straluna](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@straluna](https://discuss.elastic.co/u/straluna)\
**Post date:** [November 26, 2015, 8:51am UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/1 "2015-11-26T08:51:05Z")

</div>

Yes, i have to admit: we also have windows machine!🙂  
Is the new filebeat 1.0.0 release ready for the Windows Eventlog?  
If not, what would be the best way to capture the Eventlog? Logstash-forwarder?  
I can not find anymore the logstash-forwarder on the elasticsearch site.  
Ciao

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [November 26, 2015, 8:56am UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/2 "2015-11-26T08:56:48Z")

</div>

Admitting is the first step 🙂

The good news is that @andrewkroh is actively working it, it's going to be its own Beat: [https://github.com/elastic/beats/winlogbeat](https://github.com/elastic/beats/winlogbeat)

We plan to release with our next Beats version (1.1). If you are reeealy adventurous, we cannot stop you from trying it already, but we don't have yet nightly builds for it, so you'd have to compile it yourself.

---

<div class="post-metadata">

**Author:** ![usahitya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usahitya/32/6180_2.png) [@usahitya](https://discuss.elastic.co/u/usahitya)\
**Post date:** [November 26, 2015, 10:11am UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/3 "2015-11-26T10:11:42Z")

</div>

could you please share the installation steps of this winlogbeat? is it supports Windows2008R2 server?

---

<div class="post-metadata">

**Author:** ![ShraddhaBandhakavi](https://avatars.discourse-cdn.com/v4/letter/s/ba9def/32.png) [@ShraddhaBandhakavi](https://discuss.elastic.co/u/ShraddhaBandhakavi)\
**Post date:** [November 26, 2015, 12:57pm UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/4 "2015-11-26T12:57:51Z")

</div>

hi please share the steps how to work with this.  
i am new to ELK

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 26, 2015, 9:57pm UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/5 "2015-11-26T21:57:57Z")

</div>

As @tudor mentioned you need to compile this yourself. It's built in go, so any tutorial on how to compile that will help you.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [December 4, 2015, 7:11pm UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/6 "2015-12-04T19:11:22Z")

</div>

We have a [getting started guide](https://github.com/elastic/beats/blob/master/winlogbeat/docs/getting-started.asciidoc) for Winlogbeat in the Github repo (as well as other [documentation](https://github.com/elastic/beats/tree/master/winlogbeat/docs)). None of the documentation will go live on elastic.co until the software is released.

The software package can be downloaded from our [nightly build site](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=winlogbeat/).

I created a Winlogbeat category under Beats for any related questions.

---

<div class="post-metadata">

**Author:** ![woodkan](https://avatars.discourse-cdn.com/v4/letter/w/db5fbb/32.png) [@woodkan](https://discuss.elastic.co/u/woodkan)\
**Post date:** [December 9, 2015, 2:16am UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/7 "2015-12-09T02:16:38Z")

</div>

I hope winlogbeat can support on chinese windows sever.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/filebeat-and-windows-eventlog/35643/8 "2017-07-05T21:57:36Z")

</div>


