# How to backfil a saved evtx file into elasticsearch using winlogbeat

**URL:** <https://discuss.elastic.co/t/how-to-backfil-a-saved-evtx-file-into-elasticsearch-using-winlogbeat/171597>\
**Category:** Beats\
**Created:** [March 9, 2019, 4:05pm UTC](https://discuss.elastic.co/t/how-to-backfil-a-saved-evtx-file-into-elasticsearch-using-winlogbeat/171597 "2019-03-09T16:05:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![niki](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@niki](https://discuss.elastic.co/u/niki)\
**Post date:** [March 9, 2019, 4:05pm UTC](https://discuss.elastic.co/t/how-to-backfil-a-saved-evtx-file-into-elasticsearch-using-winlogbeat/171597/1 "2019-03-09T16:05:31Z")

</div>

can we backfil saved evtx files from different windows machines into elasticsearch and use them for correlation and forensics stuff?  
I used to do something like this with filebeat and webservers logs.

`zcat logname.gz | .\filebeat.exe -e -v -c backfil.yml`

and backfil.yml looks like this

```
filebeat.inputs:

- type: stdin
  enabled: true
  fields_under_root: true
  
output.logstash:
  hosts: ["logstash:5044"]

  logging.level: info
  logging.to_files: true
  logging.metrics.enabled: false
  json.overwrite_keys: true

```

common event logs have channel names and we use those names in winlogbeat.yml file, so what if i have a saved file with a custom name like sysmon.evtx and wanna put entire content into elasticsearch?  
is there any way to use the perfect event log template of winlogbeat and backfil saved evtx file straight into elasticsearch?  
thanks for answers in advance

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 11, 2019, 2:51pm UTC](https://discuss.elastic.co/t/how-to-backfil-a-saved-evtx-file-into-elasticsearch-using-winlogbeat/171597/2 "2019-03-11T14:51:37Z")

</div>

evtx files are currently not supporter by winlogbeat.  
There is a currently community PR in progress for adding support: [https://github.com/elastic/beats/pull/10629](https://github.com/elastic/beats/pull/10629)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2019, 4:51pm UTC](https://discuss.elastic.co/t/how-to-backfil-a-saved-evtx-file-into-elasticsearch-using-winlogbeat/171597/3 "2019-04-08T16:51:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.