# Get output value of powershell script
**URL:** https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768
**Category:** Beats
**Tags:** winlogbeat
**Created:** [February 21, 2022, 2:32pm UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768 "2022-02-21T14:32:35Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@ethical20](https://discuss.elastic.co/u/ethical20)
#### Post date: [February 21, 2022, 2:32pm UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768/1 "2022-02-21T14:32:36Z")
Hi,
In winlogbeat, I'm able to get the body of PowerShell script that is executed on device using:
```auto
powershell.file.script_block_text:
```
But is there a way to get the ' **stdout**' or return / output of the script?
Regrdas,
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [February 23, 2022, 6:22am UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768/2 "2022-02-23T06:22:42Z")
Dear @ethical20
Is this question related to Kibana? Sounds like more like a #elastic-stack:beats question?
Best,
Matthias
---
### Author:  [@ethical20](https://discuss.elastic.co/u/ethical20)
#### Post date: [February 23, 2022, 7:50am UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768/3 "2022-02-23T07:50:12Z")
Thanks @matw
So how can we change this post and redirect it to beats?
---
### Author:  [@matw](https://discuss.elastic.co/u/matw)
#### Post date: [February 23, 2022, 8:59am UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768/4 "2022-02-23T08:59:43Z")
I could move it to this channel, but for better visibility, I'd suggest you create a new post, and provide more details what you trying to do, what's your setup and the expected outcome. This will help you t get better and quicker feedback.
Best,
Matthias
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 23, 2022, 5:02pm UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768/5 "2022-02-23T17:02:38Z")
Winlogbeat gets its data from the Windows event log. And I think the stdout and stderr are not something that is captured by the powershell's event logging. So Winlogbeat won't be able to provide that unless it's already in the event log.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 23, 2022, 5:03pm UTC](https://discuss.elastic.co/t/get-output-value-of-powershell-script/297768/6 "2022-03-23T17:03:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.