# Windows event logs into the ECS format

**URL:** <https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002>\
**Category:** Elasticsearch\
**Created:** [December 12, 2022, 7:48am UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002 "2022-12-12T07:48:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_su](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@alex\_su](https://discuss.elastic.co/u/alex_su)\
**Post date:** [December 12, 2022, 7:48am UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002/1 "2022-12-12T07:48:07Z")

</div>

Hello, I want to ask how to use python convert windows event logs into the ECS format.

not use beats or logstash method.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 12, 2022, 12:11pm UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002/2 "2022-12-12T12:11:08Z")

</div>

If you are not going to use Beats, then you will need to build your parse in your python script, which is out of the scope of this forum.

You may look at how elastic parse the logs from windows event log and adapt it, for example, [this is the ingest pipeline](https://github.com/elastic/beats/blob/main/x-pack/winlogbeat/module/security/ingest/security.yml) used to parse the security logs.

---

<div class="post-metadata">

**Author:** ![alex\_su](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@alex\_su](https://discuss.elastic.co/u/alex_su)\
**Post date:** [December 15, 2022, 5:53am UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002/3 "2022-12-15T05:53:57Z")

</div>

Thanks your reply,

more a quesion about if I had elasticsearch to collect windows event log not ecs format,  
has any idea to transfer old data to ecs format ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2023, 5:54am UTC](https://discuss.elastic.co/t/windows-event-logs-into-the-ecs-format/321002/4 "2023-01-12T05:54:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.