# Winlogbeat - how to change path for where to look for files
**URL:** https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492
**Category:** Beats
**Tags:** winlogbeat
**Created:** [October 31, 2016, 8:49pm UTC](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492 "2016-10-31T20:49:07Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@jeriel20](https://discuss.elastic.co/u/jeriel20)
#### Post date: [October 31, 2016, 8:49pm UTC](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492/1 "2016-10-31T20:49:07Z")
Does any one know what configuration if any I can put in the YAML file to specify a location for where my windows event logs reside. I have a folder with archived data that i need winlogbeat to index into elasticsearch...
anyone know?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [October 31, 2016, 11:47pm UTC](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492/2 "2016-10-31T23:47:52Z")
Winlogbeat cannot directly read the .etvx files. The format isn't something that Microsoft has published, though it has been reverse engineered by a few people. The format is some kind of binary XML.
Winlogbeat uses the Windows API to read events from the logs that are live in the event logging system.
---
### Author:  [@jeriel20](https://discuss.elastic.co/u/jeriel20)
#### Post date: [November 1, 2016, 12:28am UTC](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492/3 "2016-11-01T00:28:40Z")
Thanks for shedding light on this. I greatly appreciate it. I think what I'll do then is convert the evtx files to CSV or XML and then run logstash or filebeat on them. Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 22, 2016, 12:28am UTC](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492/4 "2016-11-22T00:28:57Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.