# Ingesting Offline Windows Event Logs
**URL:** https://discuss.elastic.co/t/ingesting-offline-windows-event-logs/131627
**Category:** Elastic Community and Ecosystem
**Created:** [May 13, 2018, 4:01pm UTC](https://discuss.elastic.co/t/ingesting-offline-windows-event-logs/131627 "2018-05-13T16:01:53Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@steved](https://discuss.elastic.co/u/steved)
#### Post date: [May 13, 2018, 4:01pm UTC](https://discuss.elastic.co/t/ingesting-offline-windows-event-logs/131627/1 "2018-05-13T16:01:53Z")
Hello all, there's a fair amount of information around for live shipping of Windows event logs, Winlogbeat which is great in "live" but to the best of my knowledge doesn't support "offline" processing. So I'm struggling to find the right solution for processing \*.evtx files from disk (more accurately extracted from forensic images). I have looked at a few options, any pointers towards the most efficient solution would be most appreciated.
1, Running the evtx's through log2timeline (psteal) and and using Logstash to ingest into ES. this sounded great at first but the output is messy.
2, Processing the evtx's with python-evtx to create XML output, then wrangling with Logstash to ingest to ES, I'm finding this to be messy.
It would be nice if Winlogbeat could do this. Is there a recommended solution for this kind of requirement?
Any pointers are welcome.
Cheers
Steve
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 13, 2018, 7:02pm UTC](https://discuss.elastic.co/t/ingesting-offline-windows-event-logs/131627/2 "2018-05-13T19:02:40Z")
> [@steved](#):
>
> It would be nice if Winlogbeat could do this
Definitely feel free to raise a feature request against the beats repo for this 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 10, 2018, 7:02pm UTC](https://discuss.elastic.co/t/ingesting-offline-windows-event-logs/131627/3 "2018-06-10T19:02:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.