# Wazuh SIEM + Winlogbeat

**URL:** <https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490>\
**Category:** SIEM\
**Created:** [December 20, 2021, 4:31pm UTC](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490 "2021-12-20T16:31:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![IvanYboa](https://avatars.discourse-cdn.com/v4/letter/i/e19b73/32.png) [@IvanYboa](https://discuss.elastic.co/u/IvanYboa)\
**Post date:** [December 20, 2021, 4:31pm UTC](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490/1 "2021-12-20T16:31:46Z")

</div>

Hi!  
I'm new at Elasticsearch and I'm implementing the SIEM Wazuh. The team of wazuh has their own agent to collect the logs, but in the company where I'm working want that some machines run the Wazuh agents and other machines run with Winlogbeat.  
Currently the wazuh index work as expected, the problem is that I don´t know how to ingest and index the Winlogbeat logs (and work along with wazuh index). So my questions are next:

Do I need a single node for each type of logs (Winlogbeat and Wazuh)?  
And how can I load this different kind of index in Kibana?  
Thank you!

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 31, 2021, 2:33pm UTC](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490/2 "2021-12-31T14:33:00Z")

</div>

You can't mix the data from Winlogbeat with the data from Wazuh, they have different fields and mappings, so you need to use different indices, one for the data from wazuh agents and another one from the data from winlogbeat agents.

For winlogbeat can just follow the [documentation](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html) and it will help you to create the dashboards and mappings so you are able to see the data in Kibana.

---

<div class="post-metadata">

**Author:** ![IvanYboa](https://avatars.discourse-cdn.com/v4/letter/i/e19b73/32.png) [@IvanYboa](https://discuss.elastic.co/u/IvanYboa)\
**Post date:** [January 7, 2022, 6:21pm UTC](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490/3 "2022-01-07T18:21:08Z")

</div>

Thank you for the answer, so there is no problem if I collect the data from wazuh and winlogbeat in the same node?

As you say, I can't mix the data in the same index, so there is no problem if I ingest the two types of data in the same node?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2022, 6:21pm UTC](https://discuss.elastic.co/t/wazuh-siem-winlogbeat/292490/4 "2022-02-04T18:21:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.