# Using Winlogbeat for custom logfiles?

**URL:** <https://discuss.elastic.co/t/using-winlogbeat-for-custom-logfiles/100482>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 14, 2017, 8:05am UTC](https://discuss.elastic.co/t/using-winlogbeat-for-custom-logfiles/100482 "2017-09-14T08:05:46Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![londonx](https://avatars.discourse-cdn.com/v4/letter/l/da6949/32.png) [@londonx](https://discuss.elastic.co/u/londonx)\
**Post date:** [September 14, 2017, 2:24pm UTC](https://discuss.elastic.co/t/using-winlogbeat-for-custom-logfiles/100482/6 "2017-09-14T14:24:16Z")

</div>

Yeah Winlogbeat is dedicated to Windows Event logs. For your Application logs you can use Filebeat [https://www.elastic.co/products/beats](https://www.elastic.co/products/beats) to send your application log data to Elastic.

Alternatively to Filebeat you can use the "File" input plugin (included by default) in Logstash [https://www.elastic.co/products/logstash](https://www.elastic.co/products/logstash). Logstash is the heavy duty option in that it has plenty of options to perform a lot transformation and filtering (can use grok) on the data before it sends it on to Elastic. So depending on your situation, Filebeat may suffice.

An example of using the Logstash file input plugin to add fields to log entries from an application (called Crystal in this case) log file using a wildcard as the log filenames contain a date stamp. Also note because I have used a wildcard I have to use forward slashes for the Windows path:

```
# Input from Crystal Logs

input {
     file {
           type => "Crystal"
           path => "C:/Logs/Crystal*.log"
          }
}

# Transformation Section to add extra Fields to Crystal log events

filter {

  if [type] == "Crystal" {
       mutate {
          add_field => { 
       		           "env" => "qa"
       		           "region" => "UK"
                       }
                }
          }
}

# Output to Elastic Search section

output {
    elasticsearch {
                hosts => "xxx.xxx.xxx.xxx"
                index => "logstash-crystal-%{+YYYY.MM.DD}" 
       	           }
}

```

There is no way to use any of the Beats or Logstash to housekeep the log files that it processes. Might be a useful feature request!

---

_[View the full topic](https://discuss.elastic.co/t/using-winlogbeat-for-custom-logfiles/100482)._