# Use winlogbeat to convert windows event logs to json?

**URL:** <https://discuss.elastic.co/t/use-winlogbeat-to-convert-windows-event-logs-to-json/345126>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 16, 2023, 4:00pm UTC](https://discuss.elastic.co/t/use-winlogbeat-to-convert-windows-event-logs-to-json/345126 "2023-10-16T16:00:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [October 16, 2023, 4:00pm UTC](https://discuss.elastic.co/t/use-winlogbeat-to-convert-windows-event-logs-to-json/345126/1 "2023-10-16T16:00:30Z")

</div>

Is it still possible to use winlogbeat to convert evtx files to json?

I was trying to use the powershell script from here -

> **[GitHub - sukster/evtx2json: Convert .evtx files to .json](https://github.com/sukster/evtx2json/tree/main)**
>
> main

```auto
 If(Test-Path -path $pwd\winlogbeat.exe) {
 	echo "Starting conversion from EVTX to JSON ..."
 	$EVTX_FILE_NAME = [io.path]::GetFileNameWithoutExtension((Get-ChildItem -Path $pwd\*.evtx | Select-Object -ExpandProperty Name))
 	.\winlogbeat.exe -e -c .\winlogbeat-evtx.yml -E EVTX_FILE=$pwd\$EVTX_FILE_NAME.evtx -E JSON_FILE=$pwd\$EVTX_FILE_NAME.json
 	Remove-Item -Path $pwd\data\ -Recurse
 	echo "Conversion is complete! See the new file: $EVTX_FILE_NAME.json"
 }
 Else
 {
 	echo "The winlogbeat.exe is missing! Please download the ZIP version from https://www.elastic.co/downloads/beats/winlogbeat, extract it and add the winlogbeat.exe into this folder."
}

```

and the winlogbeat-evtx.yml file

```auto
 winlogbeat.event_logs:
   - name: ${EVTX_FILE}
     no_more_events: stop
 
 output.file:
   path: "."
   filename: ${JSON_FILE}

```

I kept getting errors until I went all the way back to winlogbeat.exe 8.0, and at this point it just seems to count up through these ndjson files.

Now I don't get errors BUT this goes on for days....

![image](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f48cd73b47c5e50ff2e81c6924240543913f1d38.png)

I also tried this one -

> <https://gist.github.com/2XXE-SRA/548f856f2161341a6c405944db91d645>

I'd appreciate any thoughts or help, thanks!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2023, 6:00pm UTC](https://discuss.elastic.co/t/use-winlogbeat-to-convert-windows-event-logs-to-json/345126/2 "2023-11-13T18:00:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.