# Re-import archived Windows Event Logs **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [June 11, 2018, 2:45pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393 "2018-06-11T14:45:19Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![erikjsmith](https://avatars.discourse-cdn.com/v4/letter/e/48db29/32.png) [@erikjsmith](https://discuss.elastic.co/u/erikjsmith)\ **Post date:** [June 11, 2018, 2:45pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/1 "2018-06-11T14:45:20Z")
I have Windows Event Logs archived on my Windows Event Collector that are forwarded events from my endpoints. How can I re-import those into an ELK 6 stack? My WEC server has Winlogbeat installed and is sending the current Forwarded Events to my Logstash server. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 11, 2018, 2:47pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/2 "2018-06-11T14:47:49Z")
All of the state kept by Winlogbeat is recorded to `C:\ProgramData\winlogbeat\.winlobeat.yml`. If you stop Winlogbeat, remove that file, and then restart Winlogbeat it will be just like the first time you ran it. ---
**Author:** ![erikjsmith](https://avatars.discourse-cdn.com/v4/letter/e/48db29/32.png) [@erikjsmith](https://discuss.elastic.co/u/erikjsmith)\ **Post date:** [June 11, 2018, 2:50pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/3 "2018-06-11T14:50:16Z")
Ok, will that ingest all of the Archive-FowardedEvents\* .evtx files as well as the ForwardedEvents.evtx automatically? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 11, 2018, 2:54pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/4 "2018-06-11T14:54:33Z")
It uses the Windows API to read the data rather than reading evtx files directly so it should get the same data that's visible in the Event Viewer. (Not sure whether that includes archived data, but my guess is not.) ---
**Author:** ![erikjsmith](https://avatars.discourse-cdn.com/v4/letter/e/48db29/32.png) [@erikjsmith](https://discuss.elastic.co/u/erikjsmith)\ **Post date:** [June 11, 2018, 3:03pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/5 "2018-06-11T15:03:34Z")
Ok, so that goes back to my original question. How do I get the archived .evtx files into my Logstash then? It doesn't seem feasible to take tens of thousands of archived evtx files and manually add each one back into Event Viewer. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 11, 2018, 3:18pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/6 "2018-06-11T15:18:03Z")
I missed the subtleties of "archived" in the first question. Unfortunately if the messages aren't available through the event log APIs then it won't be able to ingest them. There has been discussion of adding .evtx support to Winlogbeat but it hasn't happened yet: [https://github.com/elastic/beats/issues/465#issuecomment-227347863](https://github.com/elastic/beats/issues/465#issuecomment-227347863) ---
**Author:** ![erikjsmith](https://avatars.discourse-cdn.com/v4/letter/e/48db29/32.png) [@erikjsmith](https://discuss.elastic.co/u/erikjsmith)\ **Post date:** [June 11, 2018, 3:30pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/7 "2018-06-11T15:30:11Z")
Ok. So if I can't use Winlogbeat, what can I use? Or, how can I make roughly 100,000 evtx files import into the event log API without adding each one manually? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 11, 2018, 3:53pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/8 "2018-06-11T15:53:35Z")
If it's a one time load thing then I'd probably script something that converts the evtx to JSON and ingests that with Filebeat. Maybe something like: - Use [https://github.com/0xrawsec/golang-evtx](https://github.com/0xrawsec/golang-evtx) to dump evtx to JSON - Run filebeat with JSON parsing enabled - Have filebeat send it to Logstash where you can rename the fields as needed ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 9, 2018, 5:53pm UTC](https://discuss.elastic.co/t/re-import-archived-windows-event-logs/135393/9 "2018-07-09T17:53:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.