# Filtering Winlogbeat Events **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [February 6, 2016, 10:39am UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116 "2016-02-06T10:39:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Post date:** [February 6, 2016, 10:39am UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/1 "2016-02-06T10:39:59Z")
Is it possible to filter the Windows Event Logs on severity? I couldn't find anything about it in the Winlogbeat documentation. I know I can filter it in logstash, but I'd like to filter before sending it over the wire. ---
**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Post date:** [February 12, 2016, 12:27pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/2 "2016-02-12T12:27:51Z")
Anyone? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 12, 2016, 1:59pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/3 "2016-02-12T13:59:28Z")
Hi @renevdm, sorry I missed your original message. It is not currently possible to filter on severity. Beats will be adding a generic filtering mechanism that can be used for this, see the discussion here [https://github.com/elastic/beats/issues/451](https://github.com/elastic/beats/issues/451). I am also open to implementing (or accepting a PR) to add a severity filter directly in Winlogbeat. This would modify the query used to retrieve events from the Windows API. It would save a few CPU cycles because the events would be dropped earlier. [Issue 465](https://github.com/elastic/beats/issues/465#issuecomment-163352546) mentions a severity filter among other features. ---
**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Post date:** [February 12, 2016, 2:55pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/4 "2016-02-12T14:55:41Z")
Thanks @andrewkroh! I'll dive into those topics, looks good and promising! 🙂 ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 9, 2016, 2:20pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/5 "2016-03-09T14:20:51Z")
There is also a feature request to enable the use of the Windows XML XPath queries. [https://github.com/elastic/beats/issues/1054](https://github.com/elastic/beats/issues/1054) ---
**Author:** ![Jim\_Jepson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jim_jepson/32/8777_2.png) [@Jim\_Jepson](https://discuss.elastic.co/u/Jim_Jepson)\ **Post date:** [March 14, 2016, 3:28pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/6 "2016-03-14T15:28:18Z")
Also would be helpful to be able to filter on event log keywords e.g. "Audit Failure". ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d05a140b09e14dd50427c6afea702af4659f1fa6.png) ---
**Author:** ![jeriel20](https://avatars.discourse-cdn.com/v4/letter/j/2bfe46/32.png) [@jeriel20](https://discuss.elastic.co/u/jeriel20)\ **Post date:** [October 31, 2016, 8:45pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/7 "2016-10-31T20:45:29Z")
DOES anyone know how to change the path location for where Winlogbeat looks for event Logs? I have event logs from a remote host copied to my local machine and want to leverage WINLLOGBEAT to index my archived logs. I don't see it anywhere in the DOCS. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:50pm UTC](https://discuss.elastic.co/t/filtering-winlogbeat-events/41116/8 "2017-07-05T21:50:21Z")