# Uploading Event Logs

**URL:** <https://discuss.elastic.co/t/uploading-event-logs/138667>\
**Category:** Kibana\
**Created:** [July 5, 2018, 8:32am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667 "2018-07-05T08:32:50Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 8:32am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/1 "2018-07-05T08:32:50Z")

</div>

Does anyone know how to upload Windows Event Logs to my Linux VM?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 5, 2018, 10:07am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/2 "2018-07-05T10:07:28Z")

</div>

Have you had a look at [Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html)?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 10:09am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/3 "2018-07-05T10:09:50Z")

</div>

Yes, had some issues - I reinstalled and this is my configuration file:  
#======================= Winlogbeat specific options ==========================

```
winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
  - name: Security
  - name: System

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["IP:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

```

For some reason nothing is coming up in Kibana

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 5, 2018, 10:10am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/4 "2018-07-05T10:10:41Z")

</div>

What does your Logstash config look like?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 10:17am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/5 "2018-07-05T10:17:42Z")

</div>

Is logstash-nginx.es.conf file meant to be in the /logstash/conf.d?  
I have:  
02-beats:

```
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

```

10-syslog

```
filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    syslog_pri { }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

```

30-elasticsearch

```
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 5, 2018, 10:20am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/6 "2018-07-05T10:20:56Z")

</div>

What do those config files look like?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 10:21am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/7 "2018-07-05T10:21:41Z")

</div>

I just edited my last response

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 5, 2018, 10:24am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/8 "2018-07-05T10:24:18Z")

</div>

It seems you have SSL configured for the beats input but not for Winlogbeat. Can you try and disable SSL in the beats input to see if this allows data to flow? Is there anything in the Winlogbeat logs?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 10:26am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/9 "2018-07-05T10:26:11Z")

</div>

I am taking it by disabling SSL you mean either delete or comment it out or do you mean set ssl =\> False?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 5, 2018, 10:27am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/10 "2018-07-05T10:27:10Z")

</div>

Yes.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 10:28am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/11 "2018-07-05T10:28:39Z")

</div>

So this is the config file now:

```
input {
  beats {
    port => 5044
   # ssl => true
   # ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
   # ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

```

There are no logs in the winlogbeat file. Last attempt I had at winlogbeats it had a log file, but now that I reinstalled everything, it doesnt create one.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 11:00am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/12 "2018-07-05T11:00:42Z")

</div>

Do you happen to have any good tutorials for installing Beats in Linux so that I can forward Event Logs?  
I have tried many but I always end up having to mix them otherwise it doesn't work.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 5, 2018, 11:04am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/13 "2018-07-05T11:04:48Z")

</div>

Winlogbeat will need to run on a Windows box as it is Windows specific.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 11:05am UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/14 "2018-07-05T11:05:33Z")

</div>

I am running on a windows box.  
I've been having issues forwarding these logs for days. Do you know any good tutorials out there for setting Beats up ?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 12:18pm UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/15 "2018-07-05T12:18:33Z")

</div>

Any clues to why it isnt producing a log file?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2018, 12:18pm UTC](https://discuss.elastic.co/t/uploading-event-logs/138667/16 "2018-08-02T12:18:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.