# Import Windows Event Dashboard

**URL:** <https://discuss.elastic.co/t/import-windows-event-dashboard/192495>\
**Category:** Kibana\
**Created:** [July 26, 2019, 7:58pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495 "2019-07-26T19:58:34Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\
**Post date:** [July 26, 2019, 7:58pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495/1 "2019-07-26T19:58:34Z")

</div>

Hello there,

Is there a good Windows Event Dashboard/Visualizations that I can import from somewhere? I don't really care what it monitors, I'd just like to be able to find something that I can interact with without having to build something from scratch at the moment.

I have windows events imported and separated into fields/values. Any suggestions would be great.

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 26, 2019, 11:17pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495/2 "2019-07-26T23:17:32Z")

</div>

Have you taken a look at WinLogBeat? There are sample dashboards it will import: [https://www.elastic.co/downloads/beats/winlogbeat](https://www.elastic.co/downloads/beats/winlogbeat)

Specifically Step 5 of [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html)

---

<div class="post-metadata">

**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\
**Post date:** [July 30, 2019, 1:15pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495/3 "2019-07-30T13:15:47Z")

</div>

At this time, we are not using Beats to send logs because it wasn't around during the first implementation of ELK.

Is there another method you can suggest?

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 30, 2019, 3:02pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495/4 "2019-07-30T15:02:29Z")

</div>

Any dashboard you get will have to be aware of the data and the format it is in. So unless your using something like Beats to ingest the data and they have a sample dashboard to use I am afraid you're not going to have much luck.

At the end of the day, creating visualizations is quite easy and it's just a matter of adding them to a dashboard.

---

<div class="post-metadata">

**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\
**Post date:** [July 30, 2019, 5:21pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495/5 "2019-07-30T17:21:04Z")

</div>

Alright. Thanks for that intel. I'm not really the creative type, so I was hoping to find something flashy that someone did with JSON scripts. I figured that would be pretty universal since Windows events have the same fields in Server 2008+. Looks like I'll have to keep on researching things that others find useful and try to implement that.

Thanks 😃

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 30, 2019, 5:35pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495/6 "2019-07-30T17:35:53Z")

</div>

While the windows events are similar, you can break up that data and index it in many ways or have additional post-processing. For Beats, we have developed what we call the Elastic Common Schema which we hope to create a standardized naming convention for this type of data across the industry. You can read more about that here: [https://www.elastic.co/blog/introducing-the-elastic-common-schema](https://www.elastic.co/blog/introducing-the-elastic-common-schema).

Maybe give WinLogBeat a try?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2019, 5:36pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495/7 "2019-08-27T17:36:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
