# Parsing Windows Event Logs in syslog format

**URL:** <https://discuss.elastic.co/t/parsing-windows-event-logs-in-syslog-format/364115>\
**Category:** Logstash\
**Created:** [July 31, 2024, 8:01am UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-in-syslog-format/364115 "2024-07-31T08:01:24Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 31, 2024, 12:17pm UTC](https://discuss.elastic.co/t/parsing-windows-event-logs-in-syslog-format/364115/2 "2024-07-31T12:17:43Z")

</div>

> [@miko](#):
>
> I'm looking for a way to parse Windows logs that are send via SYSLOG format.

That is a difficult problem. See [this](https://discuss.elastic.co/t/logstash-parse-windows-event-nxlog/303138) thread. I would guess that the first few fields are positional, so you could use either dissect or grok. But once you get into event specific data the format is also event specific. There are multiple fields that contain whitespace which are also separated by whitespace. It's hard to parse that.

---

_[View the full topic](https://discuss.elastic.co/t/parsing-windows-event-logs-in-syslog-format/364115)._