# How can logs be forwarded from a Windows server (AD) to a centralized log server using Filebeat and Logstash?

**URL:** <https://discuss.elastic.co/t/how-can-logs-be-forwarded-from-a-windows-server-ad-to-a-centralized-log-server-using-filebeat-and-logstash/362830>\
**Category:** Logstash\
**Created:** [July 10, 2024, 12:39am UTC](https://discuss.elastic.co/t/how-can-logs-be-forwarded-from-a-windows-server-ad-to-a-centralized-log-server-using-filebeat-and-logstash/362830 "2024-07-10T00:39:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sehran\_Rasool](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sehran_rasool/32/135927_2.png) [@Sehran\_Rasool](https://discuss.elastic.co/u/Sehran_Rasool)\
**Post date:** [July 10, 2024, 12:39am UTC](https://discuss.elastic.co/t/how-can-logs-be-forwarded-from-a-windows-server-ad-to-a-centralized-log-server-using-filebeat-and-logstash/362830/1 "2024-07-10T00:39:37Z")

</div>

I'm seeking assistance with forwarding Windows Server Active Directory logs to my centralized Linux-based log server. I've set up Filebeat on the Windows Server and Logstash on the log server (linux). Despite configuring both Filebeat and Logstash, I'm not recieving the logs on logstash.

CONFIGURATION OF FILEBEAT _Filebeat.yml_

```auto
###################### Filebeat Configuration Example #########################

filebeat.inputs:
  - type: filestream
    enabled: true
    paths:
      - C:\Windows\System32\winevt\Logs\*

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 60s

setup.template.settings:
  index.number_of_shards: 1

output.logstash:
  hosts: ["IP Address xxx:port number"]

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded

```

logstash conf file _logstash.conf_

```auto
input {
  beats{
    host => "IP Address"
    port => "Port Num"
  }
}
output{
  file {
    path => "/var/log/testwin.log"
    codec => "line"
  }
}

```

I've configured Filebeat to collect Windows Event Logs using an alternative method but still not recieve logs:

```auto
filebeat.inputs:
- type: winlog
  event_logs:
    - name: Application
      ignore_older: 72h
    - name: Security
    - name: System

```

Both Filebeat and Logstash are deployed across different platforms (Windows and Linux) within the same network. Despite specifying the IP and port on both platforms, I'm still not receiving the logs.