# Parsing logs from winlogbeats to Arcsight CEF

**URL:** <https://discuss.elastic.co/t/parsing-logs-from-winlogbeats-to-arcsight-cef/121549>\
**Category:** Logstash\
**Created:** [February 26, 2018, 6:56pm UTC](https://discuss.elastic.co/t/parsing-logs-from-winlogbeats-to-arcsight-cef/121549 "2018-02-26T18:56:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ecamero2](https://avatars.discourse-cdn.com/v4/letter/e/258eb7/32.png) [@ecamero2](https://discuss.elastic.co/u/ecamero2)\
**Post date:** [February 26, 2018, 6:56pm UTC](https://discuss.elastic.co/t/parsing-logs-from-winlogbeats-to-arcsight-cef/121549/1 "2018-02-26T18:56:24Z")

</div>

Hello,

I am looking for a way to parse events from winlogbeats through logstash to various destinations. We will be sending some events into Elasticsearch, some into tenable security center, and some into Arcsight. What is the best way to handle sending the events to Arcsight (ideally in CEF)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2018, 6:56pm UTC](https://discuss.elastic.co/t/parsing-logs-from-winlogbeats-to-arcsight-cef/121549/2 "2018-03-26T18:56:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.