# Old evtx-File with winlogbeat read in
**URL:** https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636
**Category:** Beats
**Tags:** winlogbeat
**Created:** [September 23, 2020, 10:08am UTC](https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636 "2020-09-23T10:08:53Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@PatNae](https://discuss.elastic.co/u/PatNae)
#### Post date: [September 23, 2020, 10:08am UTC](https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636/1 "2020-09-23T10:08:54Z")
how can i read an old logfile with winlogbeat. I have seen the following:
winlogbeat.event\_logs:
- name: ${EVTX\_FILE}
no\_more\_events: stop
But what exactly do I have to write in name/path? Where must my file be located? I have a local evtx-file on my machine and want to send this file to elasticsearch with winlogbeat - logstash.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 23, 2020, 10:41pm UTC](https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636/2 "2020-09-23T22:41:52Z")
There's an example in [the docs](https://www.elastic.co/guide/en/beats/winlogbeat/7.9/reading-from-evtx.html) that might help here;
```auto
.\winlogbeat.exe -e -c .\winlogbeat-evtx.yml -E EVTX_FILE=c:\backup\Security-2019.01.evtx
```
---
### Author:  [@PatNae](https://discuss.elastic.co/u/PatNae)
#### Post date: [September 24, 2020, 9:44am UTC](https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636/3 "2020-09-24T09:44:43Z")
Great, tnx!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2020, 11:44am UTC](https://discuss.elastic.co/t/old-evtx-file-with-winlogbeat-read-in/249636/4 "2020-10-22T11:44:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.