# Reingest Winlogbeat Events through Logstash

**URL:** <https://discuss.elastic.co/t/reingest-winlogbeat-events-through-logstash/238914>\
**Category:** Logstash\
**Created:** [June 26, 2020, 8:57pm UTC](https://discuss.elastic.co/t/reingest-winlogbeat-events-through-logstash/238914 "2020-06-26T20:57:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [June 26, 2020, 8:57pm UTC](https://discuss.elastic.co/t/reingest-winlogbeat-events-through-logstash/238914/1 "2020-06-26T20:57:50Z")

</div>

Not really sure where to put this question since it involves a lot of different parts of the stack....

I am currently ingesting windows event logs from a server --\> logstash --\> elasticsearch. I have modified my logstash pipeline and now need to reingest all the events that have been indexed in elasticsearch.

I initially started to use the scroll API to bulk export the events and then save the contents of the message field to be reingested using a file input. However, looking at the exported message field, it looks like this:

```auto
More information for the event entry with Instance ID 120a2df6-3bdd-43f5-a25d-252b58ca1969. There may be more events with the same Instance ID with more information. 

Instance ID: 
 
Caller identity: 
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid 

```

Obviously, this is problematic because it's not on a single line. So I guess the question is, what's the data look like as it comes into Logstash from winlogbeat? Is there a way I can have these events reingested through Logstash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2020, 8:57pm UTC](https://discuss.elastic.co/t/reingest-winlogbeat-events-through-logstash/238914/2 "2020-07-24T20:57:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.