# Ingesting Winlogbeat File output Text file

**URL:** https://discuss.elastic.co/t/ingesting-winlogbeat-file-output-text-file/240925
**Category:** Logstash
**Created:** [July 13, 2020, 8:44am UTC](https://discuss.elastic.co/t/ingesting-winlogbeat-file-output-text-file/240925 "2020-07-13T08:44:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![OntheHighSeas](https://avatars.discourse-cdn.com/v4/letter/o/848f3c/32.png) [@OntheHighSeas](https://discuss.elastic.co/u/OntheHighSeas)
#### Post date: [July 13, 2020, 8:44am UTC](https://discuss.elastic.co/t/ingesting-winlogbeat-file-output-text-file/240925/1 "2020-07-13T08:44:11Z")

</div>

Hi,  
Apologies if this should be in the Beats section, though I think it should be Logstash.

I need to ingest WInlogbeat events from a system which has WinlogBeats installed but is using a File output, rather than Logstash or Elastic. I'm then retrieving the files, they're located on a completely different isolated environment. That's the reason for the unusual configuration. I'm unsure how I should go about ingesting the JSON in the text files. I'm assuming there is a trick which will we see Logstash immediately understand the structure of the document and I don't need to worry about the writing a Filter.

Or should I be attempting to use Filebeats

I'm using v7.8

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 10, 2020, 8:44am UTC](https://discuss.elastic.co/t/ingesting-winlogbeat-file-output-text-file/240925/2 "2020-08-10T08:44:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
