Hello, I have .evtx logs saved to CD/DVDs that I would like elasticsearch to ingest. Is there a way to change the path that winlogbeat uses to check for logs? I've tried converting them to .csv files and utilizing filebeat to send to elasticsearch, which works (sort of). But not all of the fields a…

A solutions engineer provided me with the following: file.output --> Elasticsearch After installing Winlogbeat on the machines producing the logs contained on my CD/DVDs ... ...Using this approach, you would be able to pull JSON-formatted. logs from isolated machines, move them to a machin…

Discuss the Elastic Stack

Import Saved Windows Event Logs

Elastic Stack Beats

andrewkroh (Andrew Kroh) May 10, 2017, 10:08pm 2

It's not possible to use Winlogbeat for this. Though it would be great feature.

Topic		Replies	Views
Winlogbeat - how to change path for where to look for files Beats winlogbeat	3	1672	November 22, 2016
Winlogbeat: Logstash as forensic investigator Beats winlogbeat	3	1463	December 31, 2016
Upload Windows Event Logs Beats filebeat , winlogbeat	5	1184	March 3, 2022
How can I parse Windows Logs? Elasticsearch	7	6519	June 2, 2018
Old evtx-File with winlogbeat read in Beats winlogbeat	3	345	October 22, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Import Saved Windows Event Logs

Related topics