# Filebeat and Winlogbeat **URL:** \ **Category:** Beats\ **Tags:** filebeat, winlogbeat\ **Created:** [April 30, 2021, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780 "2021-04-30T13:14:24Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![insurin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/insurin/32/81969_2.png) [@insurin](https://discuss.elastic.co/u/insurin)\ **Post date:** [April 30, 2021, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/1 "2021-04-30T13:14:24Z")
I am enrolling my Windows servers in Fleet on ELK 7.12. I can see lots of 'logs-\* via discover relating to these servers. Do I need to manually install winlogbeat and or filebeat in addition to what I already have. My current integration has 'Endpoint Security' and 'System' Do I also need winlogbeat if I already have filebeat. Apologies for the confusion here. For example lets say I am going to add a Windows DC. I am interested in view logs about lockouts, logon failures etc. Do I just deploy the Fleet Agent or do I deploy the fleet agent, then install filebeat and then install winlogbeat? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 3, 2021, 2:45am UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/2 "2021-05-03T02:45:20Z")
If I am understanding you correctly You can just use the Fleet elastic agent and add integration to the Agent policy such as custom logs or window events. Go to the policy and add integration. ![Screen Shot 2021-05-02 at 7.42.19 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c7868f227d3fda8446729b1f42c9340754123c65.png) Then add Windows or Custom logs depending on what you want to do ![Screen Shot 2021-05-02 at 7.44.26 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/c/ac25043f4d83d0212248f40c406ba438989f9363.png) ![Screen Shot 2021-05-02 at 7.44.35 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f50aebf423f5fdffdd44465ec6da73be4705db3d.png) ---
**Author:** ![insurin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/insurin/32/81969_2.png) [@insurin](https://discuss.elastic.co/u/insurin)\ **Post date:** [May 3, 2021, 3:17pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/3 "2021-05-03T15:17:49Z")
ok, I get you. I have added Windows into my agent settings like you said so I have in total, Endpoint Security, System and Windows. Now I may be wrong but I am assunming that by adding Windows intergration, this will add winlogbeat but I cannot see that within the Windows server after deploying the fleet agent (see screenshots). ![fleet](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d91495a46c434ae50f1189667239c5da17bf00bf.png) ![win](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0f01e0f0cd2d704d404e1f29344660e3ccf70cbc.png) Should I be expecting Winlogbeat if I have added Windows into the integration? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 3, 2021, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/4 "2021-05-03T15:35:40Z")
Interesting I don't have a windows machine handy, are you collecting / seeing the windows events that you configured? ---
**Author:** ![insurin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/insurin/32/81969_2.png) [@insurin](https://discuss.elastic.co/u/insurin)\ **Post date:** [May 3, 2021, 4:26pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/5 "2021-05-03T16:26:37Z")
If I go to Discover, I get data for 'logs-_' and 'Metrics-_' but don't see anything for 'Winlogbeat-\*' for this partilcuar Windows server that has Endpoint Security, System and Windows configured on its agent. ---
**Author:** ![insurin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/insurin/32/81969_2.png) [@insurin](https://discuss.elastic.co/u/insurin)\ **Post date:** [May 4, 2021, 8:16pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/6 "2021-05-04T20:16:35Z")
right then. What I have done is just install winlogbeat onto my DC's. No agent etc and just winlogbeat for now but I can see all the data flying in on the dashboard which is really good. I can see all my lockouts, logons, changes to AD accounts etc. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 4, 2021, 11:48pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/7 "2021-05-04T23:48:41Z")
Ok good.. yeah I tried install Windows through the agent and wasn't having a lot of luck either if I get a chance I'll take a look keep an eye out it's my understanding that the agent should do this at some point it is still beta so perhaps there's an issue ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 1, 2021, 11:48pm UTC](https://discuss.elastic.co/t/filebeat-and-winlogbeat/271780/8 "2021-06-01T23:48:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.