# Windows Event Logs Showing as Filebeat — Expected Winlogbeat **URL:** \ **Category:** Elastic Agent\ **Created:** [November 27, 2025, 10:40pm UTC](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746 "2025-11-27T22:40:42Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![shalev\_aviram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalev_aviram/32/145944_2.png) [@shalev\_aviram](https://discuss.elastic.co/u/shalev_aviram)\ **Post date:** [November 27, 2025, 10:40pm UTC](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746/1 "2025-11-27T22:40:42Z")
Hi everyone, new here (: I have a question regarding Windows logs collected via Elastic Agent + Fleet. In some integrations (like windows - sysmon..) where I expect to see agent.type = winlogbeat, I instead see agent.type = filebeat. Does this difference affect the format of the Windows event logs, or is it just a naming/agent-type label while the actual ingestion format remains identical to standard Winlogbeat logs? Thanks! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 28, 2025, 4:11pm UTC](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746/2 "2025-11-28T16:11:25Z")
Hi @shalev_aviram Welcome to the community. The `agent.type` is less important than the `data_stream.type` and `data_stream.dataset` `agent.type` will be `filebeat` for the windows logs / events etc. > [@shalev\_aviram](#): > > Does this difference affect the format of the Windows event logs, or is it just a naming/agent-type label while the actual ingestion format remains identical to standard Winlogbeat logs? Identical... that is a bit tough as the agents tend to have slightly different metat data fields but yes they are essentially the same and of course improvements are made with versions. I think you may need to do a direct comparison of the exported fields if you want to do a detailed comparison. Elastic Integration > **[Windows Integration | Elastic integrations](https://www.elastic.co/docs/reference/integrations/windows)** > > The Windows integration allows you to monitor the Windows OS, services, applications, and more. Use the Windows integration to collect metrics and logs... Winlogbeat > **[Exported fields | Beats](https://www.elastic.co/docs/reference/beats/winlogbeat/exported-fields)** > > This document describes the fields that are exported by Winlogbeat. They are grouped in the following categories: Beat fields, Cloud provider metadata... Many users have migrated from Winlog beat to Elastic Agen ---
**Author:** ![shalev\_aviram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalev_aviram/32/145944_2.png) [@shalev\_aviram](https://discuss.elastic.co/u/shalev_aviram)\ **Post date:** [November 30, 2025, 3:40pm UTC](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746/3 "2025-11-30T15:40:20Z")
Thank you very much! this was very helpful