# Sending sysmon logs from Winlogbeat to Logstash **URL:** \ **Category:** Beats\ **Created:** [November 16, 2019, 5:11pm UTC](https://discuss.elastic.co/t/sending-sysmon-logs-from-winlogbeat-to-logstash/208177 "2019-11-16T17:11:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Coder\_HK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coder_hk/32/57814_2.png) [@Coder\_HK](https://discuss.elastic.co/u/Coder_HK)\ **Post date:** [November 16, 2019, 5:11pm UTC](https://discuss.elastic.co/t/sending-sysmon-logs-from-winlogbeat-to-logstash/208177/1 "2019-11-16T17:11:50Z")
I have installed ELK on ubuntu in vmware and Windows 10 is my main OS. I want to send sysmon logs to logstash that's on ubuntu from my windows system through winlogsbeat please guide me step by step how to do it .. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 18, 2019, 11:31am UTC](https://discuss.elastic.co/t/sending-sysmon-logs-from-winlogbeat-to-logstash/208177/2 "2019-11-18T11:31:46Z")
A getting start guide for Winlogbeat can be found here: [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html) You need to use the sysmon module of winlogbeat: [https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-module-sysmon.html](https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-module-sysmon.html) Configure the Logstash output: [https://www.elastic.co/guide/en/beats/winlogbeat/master/logstash-output.html](https://www.elastic.co/guide/en/beats/winlogbeat/master/logstash-output.html) ---
**Author:** ![Coder\_HK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coder_hk/32/57814_2.png) [@Coder\_HK](https://discuss.elastic.co/u/Coder_HK)\ **Post date:** [November 19, 2019, 11:06am UTC](https://discuss.elastic.co/t/sending-sysmon-logs-from-winlogbeat-to-logstash/208177/3 "2019-11-19T11:06:23Z")
I've gone through all of them yet I can't figure it out what's the matter .. I just need someone who guides me step by step and see where's the issue ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 20, 2019, 7:13am UTC](https://discuss.elastic.co/t/sending-sysmon-logs-from-winlogbeat-to-logstash/208177/4 "2019-11-20T07:13:13Z")
What is the issue? Can you share an error message? ---
**Author:** ![Coder\_HK](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coder_hk/32/57814_2.png) [@Coder\_HK](https://discuss.elastic.co/u/Coder_HK)\ **Post date:** [November 20, 2019, 1:49pm UTC](https://discuss.elastic.co/t/sending-sysmon-logs-from-winlogbeat-to-logstash/208177/5 "2019-11-20T13:49:13Z")
It's Solved .. Thank You very much ... Actually The problem wasn't in the configuration the problem was that there wasn't a connection the 2 operating systems .. I could ping one OS from the other but not Vise versa .. Once I solved that things started to run smoothly ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 18, 2019, 3:49pm UTC](https://discuss.elastic.co/t/sending-sysmon-logs-from-winlogbeat-to-logstash/208177/6 "2019-12-18T15:49:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.