# Is it possible to enrich windows integration logs ?!
**URL:** https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143
**Category:** Beats
**Tags:** windows, elastic-agent, integrations
**Created:** [January 23, 2022, 11:30am UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143 "2022-01-23T11:30:24Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)
#### Post date: [January 23, 2022, 11:30am UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/1 "2022-01-23T11:30:24Z")
Hi, I'm using windows integration to collect windows event logs, the integration settings offer a field to specify processor, but when try to use enrich processor I stop receiving new logs and i got the following error
I guess the enrich processor is not allowed as it a server-side processor depending on the enrich policy.
Is there any alternatives like having the possibility to specify a pipeline.
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [January 23, 2022, 4:04pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/2 "2022-01-23T16:04:15Z")
Currently the processor field is for local beat processors. If u want to do anything with Elasticsearch pipelines, you'd have to modify the ones that come with each integration.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 23, 2022, 4:08pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/3 "2022-01-23T16:08:47Z")
It is also possible to just set an [`index.final_pipeline`](https://www.elastic.co/guide/en/elasticsearch/reference/8.0/index-modules.html#dynamic-index-settings) in the index template to call a pipeline after the pipeline used in the integration.
This way there is no need to modify the integration pipeline, just the index template.
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [January 23, 2022, 4:11pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/4 "2022-01-23T16:11:10Z")
You have to be careful with that as every index template created by fleet managed integrations has a final pipeline already set to do certain fleet things.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 23, 2022, 4:14pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/5 "2022-01-23T16:14:19Z")
Oh thanks, didn't know, I thought it was just like the beats modules, I'm not using Elastic Agent and have no plan to use it in the near future.
So, in this case the solution would be really to add a new processor in the integration pipeline then.
---
### Author:  [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)
#### Post date: [January 23, 2022, 4:45pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/6 "2022-01-23T16:45:10Z")
Thank you very much, I will try it
---
### Author:  [@donasmello](https://discuss.elastic.co/u/donasmello)
#### Post date: [February 8, 2022, 8:58pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/7 "2022-02-08T20:58:42Z")
Would it be sensible to add your processors to the pipeline .fleet\_final\_pipeline-1 ? That one appears to be used in all of the integrations via the template .fleet\_component\_template-1. I tested with an enrich processor on the pipeline and worked so far. Can't see yet why this would be a bad idea.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 8, 2022, 10:59pm UTC](https://discuss.elastic.co/t/is-it-possible-to-enrich-windows-integration-logs/295143/8 "2022-03-08T22:59:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.