# How to collect windows event logs using Logstash?

**URL:** <https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948>\
**Category:** Logstash\
**Created:** [June 19, 2017, 2:22pm UTC](https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948 "2017-06-19T14:22:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [June 19, 2017, 2:22pm UTC](https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948/1 "2017-06-19T14:22:20Z")

</div>

Hi, I am trying to collect Windows event logs through logstash, but it's giving me an error as,

10:19:40.614 [LogStash::Runner] ERROR logstash.agent - Cannot load an invalid configuration {:reason=\>"Couldn't find any input plugin named 'eventlog'. Are you sure this is correct? Trying to load the  
eventlog input plugin resulted in this error: Problems loading the requested plugin named eventlog of type input. Error: NameError NameError"}

And also I have read that Winlogbeat is the best method to capture Windows Event logs. Can you please suggest what to use? Here is the config I am using. Any help is highly appreciated.

input{  
eventlog {  
type =\> 'Win32-EventLog'  
logfile =\> 'System'  
}  
}  
output{  
stdout {  
codec=\>rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 19, 2017, 2:26pm UTC](https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948/2 "2017-06-19T14:26:04Z")

</div>

This is exactly what [Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html) was designed for, so I would recommend using that instead.

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [June 19, 2017, 2:49pm UTC](https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948/3 "2017-06-19T14:49:25Z")

</div>

Thanks for your quick reply Christian. I will use Winlogbeat. Thanks again 🙂

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [June 19, 2017, 3:04pm UTC](https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948/4 "2017-06-19T15:04:18Z")

</div>

Christian - Do you have any idea why it is throwing errors? I've tried installing 'logstash-input-eventlog', but it's still throwing the same error.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 19, 2017, 3:20pm UTC](https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948/5 "2017-06-19T15:20:34Z")

</div>

I am not a Windows user, so will unfortunately not be able to help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2017, 3:20pm UTC](https://discuss.elastic.co/t/how-to-collect-windows-event-logs-using-logstash/89948/6 "2017-07-17T15:20:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.