# Winlogbeat and Grafana Loki

**URL:** <https://discuss.elastic.co/t/winlogbeat-and-grafana-loki/374255>\
**Category:** Elastic Observability\
**Created:** [February 8, 2025, 9:51am UTC](https://discuss.elastic.co/t/winlogbeat-and-grafana-loki/374255 "2025-02-08T09:51:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\
**Post date:** [February 8, 2025, 9:51am UTC](https://discuss.elastic.co/t/winlogbeat-and-grafana-loki/374255/1 "2025-02-08T09:51:28Z")

</div>

Hello,  
I want to send Windows Event ID `4066` to Grafana Loki server with IP address `192.168.1.2` via Winlogbeat. I wrote the following configuration file:

```auto
winlogbeat.event_logs:
  - name: Application
    event_id: 4066
  - name: Security
    event_id: 4066
  - name: System
    event_id: 4066

output.loki:
  hosts: ["http://192.168.1.2:3100"]
  labels:
    job: "windows_event_logs"
  static_labels:
    source: "windows"
    event_id: "4066"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: {}
  - add_docker_metadata: {}
  - add_kubernetes_metadata: {}
  - drop_event:
      when:
        not:
          equals:
            event.id: 4066

```

When I try to restart the `winlogbeat` service, I get error `1053`.

How to solve it?

Thank you.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 8, 2025, 12:45pm UTC](https://discuss.elastic.co/t/winlogbeat-and-grafana-loki/374255/2 "2025-02-08T12:45:30Z")

</div>

> [@hack3rcon](#):
>
> ```auto
> output.loki:
> hosts: ["http://192.168.1.2:3100"]
> labels:
> job: "windows_event_logs"
> static_labels:
> source: "windows"
> event_id: "4066"
> 
> ```

There is no `output.loki`, Winlogbeat or any other beats, does not support sending data directly to Loki, not sure from where you got this configuration as this does not exist.

The supported outputs are mentioned [here](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuring-output.html).

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\
**Post date:** [February 9, 2025, 1:37pm UTC](https://discuss.elastic.co/t/winlogbeat-and-grafana-loki/374255/3 "2025-02-09T13:37:28Z")

</div>

Hi,  
Thank you so much.