# Windows NX logs to file to logstash

**URL:** <https://discuss.elastic.co/t/windows-nx-logs-to-file-to-logstash/212366>\
**Category:** Logstash\
**Tags:** windows\
**Created:** [December 18, 2019, 4:08pm UTC](https://discuss.elastic.co/t/windows-nx-logs-to-file-to-logstash/212366 "2019-12-18T16:08:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Swisher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_swisher/32/59645_2.png) [@Ryan\_Swisher](https://discuss.elastic.co/u/Ryan_Swisher)\
**Post date:** [December 18, 2019, 4:08pm UTC](https://discuss.elastic.co/t/windows-nx-logs-to-file-to-logstash/212366/1 "2019-12-18T16:08:43Z")

</div>

we use the USM anywhere SIEM. I exported the logs from the NX log log source and spits it out to a text file.

I am using filebeat to grab this file and send to logstash. I am then struggling to get things parsed in elastic. It is parsing out the Filebeat info, but the original log information is in the "message" field.

I know this would be easier if i could just send NX Log direct to logstash, but i cant. I need to use filebeat to read a txt file and logstash to successfully parse it.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/6/56a52ffb3bca0cef93116cfe02672620b6f71452.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2020, 4:08pm UTC](https://discuss.elastic.co/t/windows-nx-logs-to-file-to-logstash/212366/2 "2020-01-15T16:08:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.