# Regarding FileBeats Configuration Issues

**URL:** <https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 11, 2025, 9:29am UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358 "2025-11-11T09:29:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RainZ](https://avatars.discourse-cdn.com/v4/letter/r/50afbb/32.png) [@RainZ](https://discuss.elastic.co/u/RainZ)\
**Post date:** [November 11, 2025, 9:29am UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358/1 "2025-11-11T09:29:18Z")

</div>

I have set up an ELK server currently in the testing phase. I deployed a Filebeats instance on a Windows Server to collect logs from Application, Security, System, and Windows PowerShell. However, my Logstash is only capturing Security logs at present. I have verified on Windows that the log channels and quantities are correct. Please provide suggestions for improvement. Below are my Logstash and Filebeats configuration files.

logstash.conf

```auto
input {
beats {
port => 5044
host => "0.0.0.0"

# Add debug fields to track host information

add_field => {
"beats_host" => "%{\[host\]\[name\]}"
"original_agent_name" => "%{\[agent\]\[name\]}"
}
}
}

filter {

if \[agent\]\[name\] {
mutate {
replace => { "host" => "%{\[agent\]\[name\]}" }
}
}

mutate {
convert => {
"host" => "string"
"\[host\]\[name\]" => "string"
"\[agent\]\[name\]" => "string"
}
}
}

output {
elasticsearch {
hosts => \["http://localhost:9200"\]
index => "logs-%{+YYYY.MM.dd}"
user => "elastic"
password => "My password"
}

stdout {
codec => rubydebug
}
}

```

filebeats.yml

```auto

filebeat.inputs:

* type: winlog
  name: Application
  #id: "Windows-App_IP"
  ignore_older: 72h
  tags: \["windows", "Application_eventlog"\]

* type: winlog
  name: Security
  #id: "Windows-Sec_IP"
  ignore_older: 72h
  tags: \["windows", "Security_eventlog"\]

* type: winlog
  name: System
  #id: "Windows-Sys_IP"
  ignore_older: 72h
  tags: \["windows", "System_eventlog"\]

* type: winlog
  name: Windows PowerShell
  #id: "Windows-PS_IP"
  ignore_older: 72h
  tags: \["windows", "Windows_PowerShell_eventlog"\]

processors:

* add_host_metadata:
  netinfo.enabled: false

name: "IP"

output.logstash:
hosts: \["ELKIP:5044"\]

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [November 14, 2025, 9:32am UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358/2 "2025-11-14T09:32:52Z")

</div>

Hello @RainZ

Welcome to the Community!!

As per your comments , filebeat is able to capture the Security logs from the Host & able to forward to elasticsearch via logstash & below is the configuration in filebeat.yml , right? :

```auto
- type: winlog
  name: Security
  #id: "Windows-Sec_IP"
  ignore_older: 72h
  tags: \["windows", "Security_eventlog"\]

```

So in elasticsearch you see records with above tags but not for other winlog type?

Please check the filebeat logs/logstash logs in order to understand why the other events are not sent to Elasticsearch search.

Thanks!!

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 14, 2025, 12:11pm UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358/3 "2025-11-14T12:11:31Z")

</div>

Hello,

Why are you scaping the square brackets in both your `logstash.conf` and `filebeat.yml`?

You should not do that.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 14, 2025, 12:17pm UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358/4 "2025-11-14T12:17:55Z")

</div>

Also, why don't you use winlogbeat?