Hello, I have .evtx logs saved to CD/DVDs that I would like elasticsearch to ingest. Is there a way to change the path that winlogbeat uses to check for logs? I've tried converting them to .csv files and utilizing filebeat to send to elasticsearch, which works (sort of). But not all of the fields a…

A solutions engineer provided me with the following: file.output --> Elasticsearch After installing Winlogbeat on the machines producing the logs contained on my CD/DVDs ... ...Using this approach, you would be able to pull JSON-formatted. logs from isolated machines, move them to a machin…

Discuss the Elastic Stack

Import Saved Windows Event Logs

Elastic Stack Beats

andrewkroh (Andrew Kroh) May 10, 2017, 10:08pm 2

It's not possible to use Winlogbeat for this. Though it would be great feature.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.