# I am using the Sysmon-\> logstash -\> elasticsearch (ELK) architecture issues **URL:** \ **Category:** Elasticsearch\ **Created:** [April 15, 2023, 11:14pm UTC](https://discuss.elastic.co/t/i-am-using-the-sysmon-logstash-elasticsearch-elk-architecture-issues/330076 "2023-04-15T23:14:36Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![iqworks](https://avatars.discourse-cdn.com/v4/letter/i/a9a28c/32.png) [@iqworks](https://discuss.elastic.co/u/iqworks)\ **Post date:** [April 15, 2023, 11:14pm UTC](https://discuss.elastic.co/t/i-am-using-the-sysmon-logstash-elasticsearch-elk-architecture-issues/330076/1 "2023-04-15T23:14:36Z")
Hi, I am trying to use sysmon to logstash to elasticsearch. After advice from others in this forum, I finally came up with a combination of parms and processing that at least shows me data from my laptop IP in kibana. This is what I have : ``` winlogbeat - I am using logstash output, enabled with a hosts: ["192.168.1.120:5044"]. elasticsearch.yml - network.hosts: ["192.168.1.120:9200"]. ``` I tried to test sysmon to kibana by creating a mspaint instance process in windows. I looked for it in kibana, but I dont see it. Perhaps its because I dont know how to look for it? This might be a clue, but 192.168.1.120 does not ping? But data gets into kibana from my IPv4 and static IP? Maybe I am not including the right sysmon includes or excludes, I only changed two : ImageLoad onmatch="include" and ProcessAccess onmatch="include" Niether of which have any rules. thanks for any help or advice. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 13, 2023, 11:15pm UTC](https://discuss.elastic.co/t/i-am-using-the-sysmon-logstash-elasticsearch-elk-architecture-issues/330076/2 "2023-05-13T23:15:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.