# Log shipping question

**URL:** <https://discuss.elastic.co/t/log-shipping-question/95477>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [August 2, 2017, 8:24am UTC](https://discuss.elastic.co/t/log-shipping-question/95477 "2017-08-02T08:24:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jarves](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jarves](https://discuss.elastic.co/u/jarves)\
**Post date:** [August 2, 2017, 8:24am UTC](https://discuss.elastic.co/t/log-shipping-question/95477/1 "2017-08-02T08:24:59Z")

</div>

Hi,

I'm new to ELK. My setup is I have a dedicated server for ELK and I have two servers to which I will get the logs which are windows event logs. Here are my questions:

Do I need to install a log shipper for each of my 2 servers(source of logs)? What logs shipper is the best?

What really happens when logs are shipped to ELK? Are the logs copied to the ELK server making it the central repository of logs?

Since in windows logs are archived when it reaches a certain file size, can ELK be able to read archived windows event logs?

Thanks!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 2, 2017, 10:24am UTC](https://discuss.elastic.co/t/log-shipping-question/95477/2 "2017-08-02T10:24:30Z")

</div>

FYI we’ve renamed ELK to the Elastic Stack, otherwise beats feels left out 😉

> [@jarves](#):
>
> Do I need to install a log shipper for each of my 2 servers(source of logs)? What logs shipper is the best?

Yes, and given these are Windows event logs then winlogbeat is the best one.

> [@jarves](#):
>
> What really happens when logs are shipped to ELK? Are the logs copied to the ELK server making it the central repository of logs?

They are copied/sent to Elasticsearch.

> [@jarves](#):
>
> Since in windows logs are archived when it reaches a certain file size, can ELK be able to read archived windows event logs?

That I don't know sorry! There is [Configure Winlogbeat | Winlogbeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#_event_logs_ignore_older) but not sure what happens if they are archived by Windows.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2017, 10:24am UTC](https://discuss.elastic.co/t/log-shipping-question/95477/3 "2017-08-30T10:24:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.