# Upload Windows Event Logs

**URL:** <https://discuss.elastic.co/t/upload-windows-event-logs/295930>\
**Category:** Beats\
**Tags:** filebeat, winlogbeat\
**Created:** [February 1, 2022, 10:38am UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930 "2022-02-01T10:38:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![smam](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@smam](https://discuss.elastic.co/u/smam)\
**Post date:** [February 1, 2022, 10:38am UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930/1 "2022-02-01T10:38:30Z")

</div>

Hello,  
Where do I find files that i sent via winlogbeat when using the Elasticsearch output? Can I add indexes?  
And how could I send just a selection of files, that is e.g. stored in some directory?  
I tried:

```auto
- name: 'C:\path\to\dir\*'
#and
- name: 'C:\path\to\file'

```

but neither of them worked.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [February 1, 2022, 2:12pm UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930/2 "2022-02-01T14:12:56Z")

</div>

Hi,

Winlogbeat cannot be used (as far as i know) to send log files. The usage of winlogbeat is meant for sending the windows event logs.

If you want to ingest log files (for example IIS logs), I recommend using [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html).

Which would then look something like

```auto
filebeat.inputs:
- type: log
  paths:
    - C:\path\to\dir\*
    - C:\path\to\dir\*

```

(might be you have to use `/` instead of `\` don't remember on top of mind)

Especially for certain inputs I recommend using the [OOTB modules](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-modules.html) provided with Filebeat as these will handle the parsing, log ingest etc for you.

---

<div class="post-metadata">

**Author:** ![smam](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@smam](https://discuss.elastic.co/u/smam)\
**Post date:** [February 3, 2022, 8:15am UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930/3 "2022-02-03T08:15:32Z")

</div>

Hi,  
Seems I did not specify that enough..

My VM is going to receive some Windows Event Log-Files from a selection of machines. These files are ment to be stored in Elasticsearch.

But the winlog.yml only contains Security/Application/.. and the addition of a path does not result in data beeing sent.

So to clarify:  
I want to know where I should set the Path for the Files I want to send.

---

<div class="post-metadata">

**Author:** ![smam](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@smam](https://discuss.elastic.co/u/smam)\
**Post date:** [February 3, 2022, 9:03am UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930/4 "2022-02-03T09:03:59Z")

</div>

This is what I tried so far

```auto
windows.event_logs:
 - name: C:/path/to/file
 - name: C:\path\to\file
 - name: "C:/path/to/file"
 - name: "C:\path\to\file"

```

I also tried:

```auto
\winlogbeat.exe -e -c .\winlogbeat-evtx.yml -E EVTX_FILE=<specific_evtx_file_path> 

```

But neither worked. Is it possible at all to just send one stored file?

---

<div class="post-metadata">

**Author:** ![smam](https://avatars.discourse-cdn.com/v4/letter/s/46a35a/32.png) [@smam](https://discuss.elastic.co/u/smam)\
**Post date:** [February 3, 2022, 12:26pm UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930/5 "2022-02-03T12:26:31Z")

</div>

Ok, I did it.  
I deleted every index and then made it work with:

```auto
windows.event_logs:
 - name: C:/path/to/file

```

So in conclusion:  
Some weird error happened before.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2022, 12:26pm UTC](https://discuss.elastic.co/t/upload-windows-event-logs/295930/6 "2022-03-03T12:26:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.