# Forward Archived .evtx files

**URL:** <https://discuss.elastic.co/t/forward-archived-evtx-files/368650>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 10, 2024, 7:40pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650 "2024-10-10T19:40:11Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![turboz](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@turboz](https://discuss.elastic.co/u/turboz)\
**Post date:** [October 10, 2024, 7:40pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650/1 "2024-10-10T19:40:11Z")

</div>

I'm trying to use this [winlogbeat config](https://www.elastic.co/guide/en/beats/winlogbeat/master/reading-from-evtx.html) suggested by elastic to forward archived events, however I'm having issues.

It paritially works I do receive events into Elastic however, randomly it will stop sending events and start sending Windows metrics from my agent I'm forwarding the logs with instead.

The desired behavior is for it to stream those logs then stop. However, that is not the experience I'm having.

I'm trying to do this with SOF-ELK (version 8.8.1) with winlogbeat version 8.8.1. I pushed the dasboards before I ingested the logs.

For the logs that do get ingested it doesn't seem like parse them correctly. When I look at the premade dasboard for Winlogbeat there are many empty fields (e.g., username).

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [October 11, 2024, 6:56pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650/2 "2024-10-11T18:56:59Z")

</div>

Can you please share an example of the Windows metrics as well as the exact winlogbeat.yml and command line you're using to run it?

---

<div class="post-metadata">

**Author:** ![turboz](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@turboz](https://discuss.elastic.co/u/turboz)\
**Post date:** [October 11, 2024, 7:59pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650/3 "2024-10-11T19:59:43Z")

</div>

It looks identical to to the example file, the only thing I changed was where the elasticsearch server was at on the "output" line.

Command I'm using to iterate logs: (requires CMD prompt)

```auto
for /r "C:\Test_logs\" %f in (*.evtx) do .\winlogbeat.exe -e -c .\archive-evtx.yml -E EVTX_FILE="%f"

```

Windows monitoring that will randomly start instead of job stopping like it should:

```auto
{"log.level":"info","@timestamp":"2024-10-11T14:02:32.061-0600","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":145},"message":"Starting metrics logging every 30s","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-10-11T13:51:19.295-0600","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":187},"message":"Non-zero metrics in the last 30s","service.name":"winlogbeat","monitoring":{"metrics":{"beat":{"cpu":{"system":{"ticks":31,"time":{"ms":31}},"total":{"ticks":62,"time":{"ms":62},"value":62},"user":{"ticks":31,"time":{"ms":31}}},"info":{"ephemeral_id":"3d2cc3fe-e247-4071-853e-a529342130a0","name":"winlogbeat","uptime":{"ms":32640},"version":"8.8.1"},"memstats":{"gc_next":9869064,"memory_alloc":4702000,"memory_sys":24828776,"memory_total":18097616,"rss":41033728},"runtime":{"goroutines":16}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0},"type":"elasticsearch"},"pipeline":{"clients":1,"events":{"active":0},"queue":{"max_events":4096}}},"system":{"cpu":{"cores":32},"handles":{"open":230}}},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-10-11T13:51:49.286-0600","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":187},"message":"Non-zero metrics in the last 30s","service.name":"winlogbeat","monitoring":{"metrics":{"beat":{"cpu":{"system":{"ticks":31},"total":{"ticks":62,"value":62},"user":{"ticks":31}},"info":{"ephemeral_id":"3d2cc3fe-e247-4071-853e-a529342130a0","uptime":{"ms":62632},"version":"8.8.1"},"memstats":{"gc_next":9869064,"memory_alloc":4797744,"memory_total":18193360,"rss":41054208},"runtime":{"goroutines":16}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":0}},"pipeline":{"clients":1,"events":{"active":0}}},"system":{"handles":{"open":-3}}},"ecs.version":"1.6.0"}}

```

Edit added line that shows "Metrics being started" (First line)

---

<div class="post-metadata">

**Author:** ![turboz](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@turboz](https://discuss.elastic.co/u/turboz)\
**Post date:** [October 11, 2024, 9:56pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650/4 "2024-10-11T21:56:37Z")

</div>

Dashboard part of this issue is paritally resolved.

I see why the dashoards aren't working for some reason a majority weren't assoicated with "winlogbeat-\*"

I updated the visuilzaitons and those work now. However, the saved queires are giving me this error below even though `winlogbeat-*` exists...

```auto
"Saved object is missing
Could not locate that data view (id: winlogbeat-*), [click here to re-create it](http://192.168.1.5:5601/app/management/kibana/dataViews)

```

I really wish there was a way to batch convert visiualizations to another Index from the GUI! This has to have been asked for thousands of times!

---

<div class="post-metadata">

**Author:** ![turboz](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@turboz](https://discuss.elastic.co/u/turboz)\
**Post date:** [October 22, 2024, 8:55pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650/5 "2024-10-22T20:55:34Z")

</div>

Just following up I provided the information you requested, but haven't heard back.

---

<div class="post-metadata">

**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\
**Post date:** [October 23, 2024, 5:57pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650/6 "2024-10-23T17:57:43Z")

</div>

> [@turboz](#):
>
> `winlogbeat-*`

Can you share a screenshot of your dataview that is called `winlogbeat-*`? This is specifically referring to a dataview, not the indices themselves

---

<div class="post-metadata">

**Author:** ![turboz](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@turboz](https://discuss.elastic.co/u/turboz)\
**Post date:** [October 24, 2024, 6:31pm UTC](https://discuss.elastic.co/t/forward-archived-evtx-files/368650/7 "2024-10-24T18:31:12Z")

</div>

Here is the screeshot you requested. Also, note I updated to latest version of SOF-ELK which now uses v8.15.2 however, the problem is the same. I'm using the matching Winlogbeat as well.

 ![kibana_dataview](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d5f876b2dcdb03d0f79fb10d75fe78a914e46e96.png)