# Windows Events with evtx

**URL:** <https://discuss.elastic.co/t/windows-events-with-evtx/264565>\
**Category:** Beats\
**Tags:** filebeat, winlogbeat\
**Created:** [February 17, 2021, 12:29pm UTC](https://discuss.elastic.co/t/windows-events-with-evtx/264565 "2021-02-17T12:29:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Christer\_Palmen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christer_palmen/32/76857_2.png) [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\
**Post date:** [February 17, 2021, 12:29pm UTC](https://discuss.elastic.co/t/windows-events-with-evtx/264565/1 "2021-02-17T12:29:26Z")

</div>

```auto
Hello.
I am trying to setup an PoC with Ingesting Windows Evenst to Elastic.
Because of company policies I can´t install Winlogbeat in any host, but the host where I have installed Elasticstack I have access to install anything as I see fit.

At the Host:s from where I want to gather logs, I have activated an Windows Event Forwarding service to the Host where I have Elasticstack, and I have confirmed that the host is collecting forwarded logs from the other host:s, this evtx file resides at
c:\Windows\System32\winevt\Logs\ForwardedEvents.evtx

What I now want to do is to ingest this evtx file to Elasticsearch, any ideas on how to proceed, Filebeat or Winlogbeat?

```

---

<div class="post-metadata">

**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\
**Post date:** [February 19, 2021, 4:07pm UTC](https://discuss.elastic.co/t/windows-events-with-evtx/264565/2 "2021-02-19T16:07:30Z")

</div>

Hi @Christer_Palmen! Winlogbeat includes support for Forwarded Events, so I'd recommend installing on the host where the events are being forwarded to and ship to Elastic from that host. Some guidance available for Forwarded Events via Winlogbeat [here](https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-modules.html).

---

<div class="post-metadata">

**Author:** ![Christer\_Palmen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christer_palmen/32/76857_2.png) [@Christer\_Palmen](https://discuss.elastic.co/u/Christer_Palmen)\
**Post date:** [February 22, 2021, 10:28am UTC](https://discuss.elastic.co/t/windows-events-with-evtx/264565/3 "2021-02-22T10:28:47Z")

</div>

´´´  
Hi James!  
Thanks for your help, fixed it!  
´´´

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2021, 12:28pm UTC](https://discuss.elastic.co/t/windows-events-with-evtx/264565/4 "2021-03-22T12:28:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.