Old evtx-File with winlogbeat read in

Elastic Stack Beats
1

how can i read an old logfile with winlogbeat. I have seen the following:
winlogbeat.event_logs:

  • name: ${EVTX_FILE}
    no_more_events: stop
    But what exactly do I have to write in name/path? Where must my file be located? I have a local evtx-file on my machine and want to send this file to elasticsearch with winlogbeat - logstash.
2

There's an example in the docs that might help here;

.\winlogbeat.exe -e -c .\winlogbeat-evtx.yml -E EVTX_FILE=c:\backup\Security-2019.01.evtx
3

Great, tnx!!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.