# Winlogbeat can't ingest archived .evtx files **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 6, 2019, 10:29pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851 "2019-05-06T22:29:19Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Post date:** [May 6, 2019, 10:29pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/1 "2019-05-06T22:29:19Z")
Hi I tried to ingest an archived evtx files. I set my configuration file like this guide [https://www.elastic.co/guide/en/beats/winlogbeat/master/faq.html#reading-from-evtx](https://www.elastic.co/guide/en/beats/winlogbeat/master/faq.html#reading-from-evtx) I create the file winlogbeat-evtx.yml like this ``` winlogbeat.event_logs: - name: C:\Users\Administrator\Downloads\audit_svm-M-cifs_last.evtx no_more_events: stop winlogbeat.shutdown_timeout: 30s winlogbeat.registry_file: evtx-registry.yml output.logstash: #hosts: ["localhost:5044"] hosts: ["192.168.107.133:5044"] ``` I check if the configuration file is correct and it is correct Then I launch from command line .\winlogbeat.exe -e -c .\winlogbeat-evtx.yml and I received this error 2019-05-07T00:02:33.966+0200 ERROR instance/beat.go:906 Exiting: Failed to create new event log. 1 error: Invalid event log key 'no\_more\_events' found. Valid keys are api, batch\_read\_size, event\_id, fields, fields\_under\_root, forwar ded, ignore\_older, include\_xml, level, name, processors, provider, tags Exiting: Failed to create new event log. 1 error: Invalid event log key 'no\_more \_events' found. Valid keys are api, batch\_read\_size, event\_id, fields, fields\_un der\_root, forwarded, ignore\_older, include\_xml, level, name, processors, provide r, tags I open the file with event viewer without the problem. Could you help me? I have logstash 6.5.4 and I use winlogbeat 6.7.2 Thank you Franco ---
**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Post date:** [May 7, 2019, 10:28am UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/2 "2019-05-07T10:28:06Z")
I tried to use another file that I created locally on the server saving all security event in a file with event viewer, but I have the same problem. I found a similar problem in this thread > [@Upload and parse exported .evtx files to Elasticsearch](https://discuss.elastic.co/t/upload-and-parse-exported-evtx-files-to-elasticsearch/175014): > > I have a use case scenario where I have to manually upload and parse Windows logs to Elasticsearch by using exported .evtx files. Splunk handles this fine with the "oneshot" command and I was wondering if anyone in this forum found a similar solution with Winlogbeat or tools that is utilizing Winlogbeat? I know that the latest version of Kibana supports upload of log files, however there is a limit to the size of files that can be uploaded, which in my case is not sufficient. The best workroun… Is it released this functionality? Thank you in advance Franco ---
**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\ **Post date:** [May 7, 2019, 11:51am UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/3 "2019-05-07T11:51:23Z")
hey @franco.federico can you please use `` button to format configuration snippet with indentations in a same way as it is in your config file? a lot of times indentation or config file is incorrectly written and I cannot say because formatting is wrong. thank you ---
**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Post date:** [May 7, 2019, 1:40pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/4 "2019-05-07T13:40:27Z")
Thank you for information. I have just used the button and save the post. I send here againg I create the file winlogbeat-evtx.yml like this ```auto winlogbeat.event_logs: - name: C:\Users\Administrator\Downloads\audit_svm-M-cifs_last.evtx no_more_events: stop winlogbeat.shutdown_timeout: 30s winlogbeat.registry_file: evtx-registry.yml output.logstash: #hosts: ["localhost:5044"] hosts: ["192.168.107.133:5044"] ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [May 7, 2019, 1:53pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/5 "2019-05-07T13:53:37Z")
This feature hasn't been released. > [@Upload and parse exported .evtx files to Elasticsearch](https://discuss.elastic.co/t/upload-and-parse-exported-evtx-files-to-elasticsearch/175014/7): > > You can download a snapshot build from here just to test it out. (It's not released yet.) [https://beats-ci.elastic.co/job/elastic+beats+master+multijob-package-linux/lastSuccessfulBuild/gcsObjects/](https://beats-ci.elastic.co/job/elastic+beats+master+multijob-package-linux/lastSuccessfulBuild/gcsObjects/) Direct link: [https://storage.googleapis.com/beats-ci-artifacts/snapshots/winlogbeat/winlogbeat-oss-8.0.0-SNAPSHOT-windows-x86\_64.zip](https://storage.googleapis.com/beats-ci-artifacts/snapshots/winlogbeat/winlogbeat-oss-8.0.0-SNAPSHOT-windows-x86_64.zip) ---
**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Post date:** [May 7, 2019, 2:35pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/6 "2019-05-07T14:35:03Z")
Ok thank you Andrew and Michal for the response. Yesterday night I don't see other thread. Franco ---
**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Post date:** [May 7, 2019, 6:15pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/7 "2019-05-07T18:15:38Z")
Now I set my winlogbeat to send to logstash instead of elasticsearch. From log di winlogbeat I see that all data are published but in the logstash log I have the following error ``` [2019-05-07T19:24:26,101][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5044, remote: 192.168.107.129:49695] Handling exception: Connection reset by peer [2019-05-07T19:24:26,102][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. java.io.IOException: Connection reset by peer at sun.nio.ch.FileDispatcherImpl.read0(Native Method) ~[?:1.8.0_191] at sun.nio.ch.SocketDispatcher.read(SocketDispatcher.java:39) ~[?:1.8.0_191] at sun.nio.ch.IOUtil.readIntoNativeBuffer(IOUtil.java:223) ~[?:1.8.0_191] at sun.nio.ch.IOUtil.read(IOUtil.java:192) ~[?:1.8.0_191] at sun.nio.ch.SocketChannelImpl.read(SocketChannelImpl.java:380) ~[?:1.8.0_191] at io.netty.buffer.PooledUnsafeDirectByteBuf.setBytes(PooledUnsafeDirectByteBuf.java:288) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.buffer.AbstractByteBuf.writeBytes(AbstractByteBuf.java:1108) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.socket.nio.NioSocketChannel.doReadBytes(NioSocketChannel.java:345) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:126) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:580) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:497) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_191] ``` This message sounds like a problem in logstash. I write a new post on the logstash community or you have information about this? Thank you Franco ---
**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\ **Post date:** [May 9, 2019, 6:24am UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/8 "2019-05-09T06:24:37Z")
hey @franco.federico thanks for coming back. please create a separate issue for this problem. it will help users while searching for similar issues. Thank you ---
**Author:** ![franco.federico](https://avatars.discourse-cdn.com/v4/letter/f/67e7ee/32.png) [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Post date:** [May 9, 2019, 11:08am UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/9 "2019-05-09T11:08:18Z")
Ok thank you Michal for reply Bye Franco ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2019, 11:08am UTC](https://discuss.elastic.co/t/winlogbeat-cant-ingest-archived-evtx-files/179851/10 "2019-06-06T11:08:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.