Hello, I have .evtx logs saved to CD/DVDs that I would like elasticsearch to ingest. Is there a way to change the path that winlogbeat uses to check for logs? I've tried converting them to .csv files and utilizing filebeat to send to elasticsearch, which works (sort of). But not all of the fields a…

A solutions engineer provided me with the following: file.output --> Elasticsearch After installing Winlogbeat on the machines producing the logs contained on my CD/DVDs ... ...Using this approach, you would be able to pull JSON-formatted. logs from isolated machines, move them to a machin…

Discuss the Elastic Stack

Import Saved Windows Event Logs

Elastic Stack Beats

andrewkroh (Andrew Kroh) May 10, 2017, 10:08pm 2

It's not possible to use Winlogbeat for this. Though it would be great feature.

Topic		Replies	Views
Winlogbeat: Logstash as forensic investigator Beats winlogbeat	3	1462	December 31, 2016
Upload Windows Event Logs Beats filebeat , winlogbeat	5	1177	March 3, 2022
How can I parse Windows Logs? Elasticsearch	7	6502	June 2, 2018
Old evtx-File with winlogbeat read in Beats winlogbeat	3	344	October 22, 2020
How to backfil a saved evtx file into elasticsearch using winlogbeat Beats	2	824	April 8, 2019

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Import Saved Windows Event Logs

Related Topics