# Send .evtx files to elastic cloud using winlogbeat

**URL:** <https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [August 18, 2021, 7:22am UTC](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779 "2021-08-18T07:22:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![msszafar](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@msszafar](https://discuss.elastic.co/u/msszafar)\
**Post date:** [August 18, 2021, 7:22am UTC](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779/1 "2021-08-18T07:22:34Z")

</div>

Hi everyone, I've more than 100 .evtx files that have to be sent to elastic cloud using winlogbeat. I know the method to send files one by one using [this post](https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html)

But this is a hectic process to provide the path of each file one by one to send .evtx logs to elastic. Is there a way to all logs in one go? Method like '/dir/path/ \*.evtx' or '/dir/path/ \*' is not working. It throws error

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [August 18, 2021, 12:17pm UTC](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779/2 "2021-08-18T12:17:50Z")

</div>

I would probably just script it with PowerShell to loop through each file and run winlogbeat on that file so u don't have to do it manually.

---

<div class="post-metadata">

**Author:** ![msszafar](https://avatars.discourse-cdn.com/v4/letter/m/ed655f/32.png) [@msszafar](https://discuss.elastic.co/u/msszafar)\
**Post date:** [August 18, 2021, 1:04pm UTC](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779/3 "2021-08-18T13:04:14Z")

</div>

Thank you this seems a great approach!

I haven't written such powershell script before, If you're an expert / experienced in it then please share script code. Meanwhile, let me try to get it done using a script. My log files are more than 500 that seems nearly impossible to do it manually.

---

<div class="post-metadata">

**Author:** ![Bryan\_Hamilton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_hamilton/32/82111_2.png) [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\
**Post date:** [September 12, 2021, 8:39pm UTC](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779/4 "2021-09-12T20:39:22Z")

</div>

Hi, the script called **Winlogbeat-Bulk-Read.ps1** from [this](https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES) github page should help you accomplish that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2021, 10:39pm UTC](https://discuss.elastic.co/t/send-evtx-files-to-elastic-cloud-using-winlogbeat/281779/5 "2021-10-10T22:39:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.