# Import Saved Windows Event Logs

**URL:** <https://discuss.elastic.co/t/import-saved-windows-event-logs/85302>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 10, 2017, 8:28pm UTC](https://discuss.elastic.co/t/import-saved-windows-event-logs/85302 "2017-05-10T20:28:13Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 10, 2017, 10:46pm UTC](https://discuss.elastic.co/t/import-saved-windows-event-logs/85302/4 "2017-05-10T22:46:19Z")

</div>

No, there's nothing in Filebeat for this either.

If you wanted to do some Go development I can potentially see a path that reuses the Winlogbeat code. You could export the records from the .evtx file to XML using the tools in windows. Then write a custom processor (similar to the [decode\_json\_fields](https://www.elastic.co/guide/en/beats/filebeat/master/decode-json-fields.html) processor ([source](https://github.com/elastic/beats/blob/master/libbeat/processors/actions/decode_json_fields.go)) that uses the [Winlogbeat code](https://github.com/elastic/beats/blob/master/winlogbeat/eventlog/wineventlog.go#L200-L203) to parse the XML. Then read the XML log lines using Filebeat and enable your custom eventlog xml processor. The config might look something like:

```auto
filebeat.prospectors:
  - paths: ['eventlog.xml']
processors:
- decode_eventlog_xml: {}
output.elasticsearch.hosts: ["http://localhost:9200"]

```

---

_[View the full topic](https://discuss.elastic.co/t/import-saved-windows-event-logs/85302)._