# Windows logstash input section for adding new input type

**URL:** <https://discuss.elastic.co/t/windows-logstash-input-section-for-adding-new-input-type/101095>\
**Category:** Logstash\
**Created:** [September 20, 2017, 3:48am UTC](https://discuss.elastic.co/t/windows-logstash-input-section-for-adding-new-input-type/101095 "2017-09-20T03:48:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sam281](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@sam281](https://discuss.elastic.co/u/sam281)\
**Post date:** [September 20, 2017, 3:48am UTC](https://discuss.elastic.co/t/windows-logstash-input-section-for-adding-new-input-type/101095/1 "2017-09-20T03:48:33Z")

</div>

Hello,

I have a few remote windows machines forwarding OS events using the WEF feature to one central windows machine and I am trying to read that data through Logstash and forward it to my application. I see below error when I try to add the new input type as 'ForwardedEvents'.

C:\logstash2.2.1\bin\>logstash --configtest -f C:\logstash2.2.1\logstash\plugins\logstash\config\logstash-scala.conf  
io/console not supported; tty will not be manipulated  
e[31mInvalid setting for eventlog input plugin:

input {  
eventlog {  
# This setting must be a ["Application", "Security", "System"]  
# Expected one of ["Application", "Security", "System"], got ["ForwardedEvents"]  
logfile =\> "ForwardedEvents"  
...  
}  
} {:level=\>:error}e[0m  
Error: Something is wrong with your configuration.

Here is my confg file input section.

######################################################### {COPYRIGHT-END} ###  
input {  
eventlog {  
type =\> 'Win32-EventLog'  
#logfile =\> 'System'  
logfile =\> 'Application'

```
}

eventlog {
	type => 'Win32-EventLog'
	logfile => 'Security'
	
}

eventlog {
	type => 'Win32-EventLog'
	logfile => 'System'
}

eventlog {
	type => 'Win32-EventLog'
	logfile => 'ForwardedEvents'
}

```

}

I have identified the forwarded events are going to be stored in a different file than the the usual System,Application or Security files.

Any thoughts are greatly appreciated. Thanks.

- 

Sam

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2017, 3:48am UTC](https://discuss.elastic.co/t/windows-logstash-input-section-for-adding-new-input-type/101095/2 "2017-10-18T03:48:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.