# WinlogBeat DNS analytical log capture
**URL:** https://discuss.elastic.co/t/winlogbeat-dns-analytical-log-capture/167644
**Category:** Beats
**Tags:** winlogbeat
**Created:** [February 8, 2019, 2:10pm UTC](https://discuss.elastic.co/t/winlogbeat-dns-analytical-log-capture/167644 "2019-02-08T14:10:11Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Jeremya5](https://discuss.elastic.co/u/Jeremya5)
#### Post date: [February 8, 2019, 2:10pm UTC](https://discuss.elastic.co/t/winlogbeat-dns-analytical-log-capture/167644/1 "2019-02-08T14:10:11Z")
hi all,
So the latest version of WinlogBeat now support all windows event logs. Currently i'm collecting (example below) across the my company. I would also like to collect the DNS analytical log, however i'm not sure how to dirive the name of this log, could someone help me out?
Current config example:
name: Application
ignore\_older: 1h
- name: Security
ignore\_older: 1h
- name: System
ignore\_older: 1h
- name: Setup
- name: Microsoft-Windows-Windows-Firewall With Advanced Security/Firewall
- name: Microsoft-Windows-Windows-Firewall With Advanced Security/FirewallVerbose
- name: Microsoft-Windows-Windows-TaskScheduler/Operational
- name: Microsoft-Windows-PowerShell/Operational
The only related topic i could find:
> [@Winlogbeats with DNS logs?](https://discuss.elastic.co/t/winlogbeats-with-dns-logs/90833):
>
> Hi I am looking for if it is possible to monitor the DNS logs through windows events/winlogbeat? I found this post here: [Windows DNS Diagnostic Logs](https://discuss.elastic.co/t/windows-dns-diagnostic-logs/53344) and people suggest to use packetbeat for DNS. Is this still the case?
Statement from WLB - "any channel"
> **[Winlogbeat: Analyze Windows Event Logs | Elastic](https://www.elastic.co/beats/winlogbeat)**
>
> Love Windows? Winlogbeat helps you ship Windows event logs to Elasticsearch (or Logstash) in a lightweight way for analysis and tracking.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 9, 2019, 2:05am UTC](https://discuss.elastic.co/t/winlogbeat-dns-analytical-log-capture/167644/2 "2019-02-09T02:05:43Z")
Analytic and Trace logs require a different API than what Winlogbeat uses.
> [@Trace Event Logs](https://discuss.elastic.co/t/trace-event-logs/75537/2):
>
> Have you see this: [https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#configuration-winlogbeat-options-event\_logs-name](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#configuration-winlogbeat-options-event_logs-name) Winlogbeat can read the logs listed by Get-WinEvent -ListLog \*. Only Analytic and Debug logs are based on ETW and Winlogbeat cannot read those. Analytic and Debug logs are disabled and hidden by default in event viewer. There has been a request to add a feature in Beats for ETW. [https://github.com/elastic/beats/issues/2073](https://github.com/elastic/beats/issues/2073)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2019, 2:05am UTC](https://discuss.elastic.co/t/winlogbeat-dns-analytical-log-capture/167644/3 "2019-03-09T02:05:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.