# Is the logs collected by winlogbeat legally valid as an evidence in court?

**URL:** <https://discuss.elastic.co/t/is-the-logs-collected-by-winlogbeat-legally-valid-as-an-evidence-in-court/212441>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 19, 2019, 5:12am UTC](https://discuss.elastic.co/t/is-the-logs-collected-by-winlogbeat-legally-valid-as-an-evidence-in-court/212441 "2019-12-19T05:12:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jawadak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jawadak/32/47236_2.png) [@jawadak](https://discuss.elastic.co/u/jawadak)\
**Post date:** [December 19, 2019, 5:12am UTC](https://discuss.elastic.co/t/is-the-logs-collected-by-winlogbeat-legally-valid-as-an-evidence-in-court/212441/1 "2019-12-19T05:12:37Z")

</div>

Hi,

I have a query related to legal purpose.

I am using winlogbeat to ship windows event logs to the elasticsearch. And winlogbeat process the logs and add extra fields to it and store it as docs in an index.

So, If I have a requirement to submit the RAW logs to an US court for investigation and forensics, can I submit these logs from the elasticsearch indices as an evidence?

If NO, what's the solution?

---

<div class="post-metadata">

**Author:** ![Jugsofbeer](https://avatars.discourse-cdn.com/v4/letter/j/9de0a6/32.png) [@Jugsofbeer](https://discuss.elastic.co/u/Jugsofbeer)\
**Post date:** [December 19, 2019, 7:18am UTC](https://discuss.elastic.co/t/is-the-logs-collected-by-winlogbeat-legally-valid-as-an-evidence-in-court/212441/2 "2019-12-19T07:18:58Z")

</div>

Shouldnt the court provide the definition of RAW log?

or at least the lawyers argue about it.

---

<div class="post-metadata">

**Author:** ![jawadak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jawadak/32/47236_2.png) [@jawadak](https://discuss.elastic.co/u/jawadak)\
**Post date:** [December 19, 2019, 7:21am UTC](https://discuss.elastic.co/t/is-the-logs-collected-by-winlogbeat-legally-valid-as-an-evidence-in-court/212441/3 "2019-12-19T07:21:03Z")

</div>

Is there any standard recommendations or format in that case?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2020, 7:27am UTC](https://discuss.elastic.co/t/is-the-logs-collected-by-winlogbeat-legally-valid-as-an-evidence-in-court/212441/4 "2020-01-16T07:27:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.