# Read Last 3 moth Historic Log from Windows Events Log

**URL:** <https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 8, 2021, 6:33am UTC](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182 "2021-10-08T06:33:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Post date:** [October 8, 2021, 6:33am UTC](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182/1 "2021-10-08T06:33:03Z")

</div>

```auto

```

> I am planning to install winlog beat in one of my Windows host.  
> How can we read last 3 month historic logs( logs generated before the winlogbeat installation) from windows event log.

```auto

```

My requirement is to read the log from last 3 months.  
For example If I am installing today , I would like to read log from July 8th.

Is this ok ?

```auto
winlogbeat.event_logs:
  - name: Application
    ignore_older: 3 months 
  - name: Security
  - name: System

```

`Or once the fresh installation of winlogbeat , did this read all historic logs ?`

---

<div class="post-metadata">

**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\
**Post date:** [October 8, 2021, 9:31am UTC](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182/2 "2021-10-08T09:31:07Z")

</div>

> [@rijinmp](#):
>
> I would like to read log from July 8th.

Hello,

It really depends on the retention file of the desired events.  
Winlogbeat will only read the eventlogs you have locally, so it depends of the entries present in your logfile (evtx if you want).  
If your local evtx does not cover 3 months, then the answer is no.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2021, 11:31am UTC](https://discuss.elastic.co/t/read-last-3-moth-historic-log-from-windows-events-log/286182/3 "2021-11-05T11:31:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.