# How to send evtx files to logstash via FIlebeat? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 8, 2019, 1:55pm UTC](https://discuss.elastic.co/t/how-to-send-evtx-files-to-logstash-via-filebeat/211008 "2019-12-08T13:55:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Coder\_HK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coder_hk/32/57814_2.png) [@Coder\_HK](https://discuss.elastic.co/u/Coder_HK)\ **Post date:** [December 8, 2019, 1:55pm UTC](https://discuss.elastic.co/t/how-to-send-evtx-files-to-logstash-via-filebeat/211008/1 "2019-12-08T13:55:44Z")
I have 300mb evtx file and I want to send this file to logstash (which is on another machine) using Filebeat. How can I do this ? NOTE: I am using winlogbeat to send windows logs to logstash and it's working fine. but I got these evtx logs from somewhere else so how can I send them to logstash ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [December 9, 2019, 10:25am UTC](https://discuss.elastic.co/t/how-to-send-evtx-files-to-logstash-via-filebeat/211008/2 "2019-12-09T10:25:23Z")
Hi @Coder_HK! Filebeat ships (text) files so I don't think you can use it directly in this case. However it seems that there are some possible solutions out there. See: > [@Import Saved Windows Event Logs](https://discuss.elastic.co/t/import-saved-windows-event-logs/85302/4): > > No, there's nothing in Filebeat for this either. If you wanted to do some Go development I can potentially see a path that reuses the Winlogbeat code. You could export the records from the .evtx file to XML using the tools in windows. Then write a custom processor (similar to the [decode\_json\_fields](https://www.elastic.co/guide/en/beats/filebeat/master/decode-json-fields.html) processor ([source](https://github.com/elastic/beats/blob/master/libbeat/processors/actions/decode_json_fields.go)) that uses the [Winlogbeat code](https://github.com/elastic/beats/blob/master/winlogbeat/eventlog/wineventlog.go#L200-L203) to parse the XML. Then read the XML log lines using Filebeat and enable your custom eventlog xml processor. The config might look something like: fil… > [@Re-import archived Windows Event Logs](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/5): > > Ok, so that goes back to my original question. How do I get the archived .evtx files into my Logstash then? It doesn't seem feasible to take tens of thousands of archived evtx files and manually add each one back into Event Viewer. Thanks! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 9, 2019, 8:27pm UTC](https://discuss.elastic.co/t/how-to-send-evtx-files-to-logstash-via-filebeat/211008/3 "2019-12-09T20:27:45Z")
The FAQ for Winlogbeat has an example of how to read an EVTX file. [https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html) You can use Winlogbeat to read the .evtx file (on a Windows host) and then send it to Logstash (the example shows elasticsearch, but you can change the output). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 6, 2020, 8:27pm UTC](https://discuss.elastic.co/t/how-to-send-evtx-files-to-logstash-via-filebeat/211008/4 "2020-01-06T20:27:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.