# Winlogbeat - Logs for Windows 7/10 and X-pack **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 24, 2018, 11:41am UTC](https://discuss.elastic.co/t/winlogbeat-logs-for-windows-7-10-and-x-pack/133134 "2018-05-24T11:41:12Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![peson79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peson79/32/31565_2.png) [@peson79](https://discuss.elastic.co/u/peson79)\ **Post date:** [May 24, 2018, 11:41am UTC](https://discuss.elastic.co/t/winlogbeat-logs-for-windows-7-10-and-x-pack/133134/1 "2018-05-24T11:41:12Z")
Hi Im in a little bit of hurry. We are in a procurement process, handling the solution today 23.59. The customer have the demand to monitor Windows OS logs and especially the Security logs. I've been looking at Winlogbeat with Elastic Search and Kibana and it looks really good. But I'm not sure of the infrastructure, can you please help me with that? My guess its enough with one server with a lots of RAM and some CPU? Thinking of both cloud and on-prem. And of course, what about support to Windows 10? It will be mostly Windows 7 in the beginning but around dec-jan they will be migrated to Windows 10. And what about x-pack, do I really need that, what's the price? 5500 Windows 10 PCs, only shipping the Security log. I'm guessing about 165 Gb data/day, storing 31 days \> 4-5Tb of data. Thanks! //Henrik ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [May 24, 2018, 5:42pm UTC](https://discuss.elastic.co/t/winlogbeat-logs-for-windows-7-10-and-x-pack/133134/2 "2018-05-24T17:42:16Z")
So, and estate of Winlogbeat agents on endpoints all pointing to a multinode Elasticsearch cluster and for insight into the data you have Kibana. 0. [https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html) We always recommend testing such. That way you can get a base line for how well a single node cluster will cope with the number of shards versus the resources allocated. What we have to go on thus far is winlogbeat-security-\* aptly named daily indices, up to 200GB per day. With a retention period of 31 days, 6.2TB So say you want to `resource performantly` keep somewhere between 500-1TB of data per data node. 1. [https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html) Lets say 1TB, which asked for 6-7 data nodes with 1TB of SSD disk plus 20% overhead. Being mindful of watermarks. We have not spoke about master nodes or sole ingest nodes. 2. [https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-allocator.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/disk-allocator.html) Presuming this will be an index heavy cluster opposed to a search one. You will opt for indexing performant tuning. 3. [https://www.elastic.co/guide/en/elasticsearch/reference/master/tune-for-indexing-speed.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/tune-for-indexing-speed.html) RAM 60+GB Whatever you feel comfortable with but as long as you set 50% to the Elasticsearch heap but no higher than 30GB! 4. [https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/heap-size.html) You will want to consider how much enrichment you want to do to your events as they come in via winglogbeat and or logstash. 5. [https://www.elastic.co/blog/elasticsearch-data-enrichment-with-logstash-a-few-security-examples](https://www.elastic.co/blog/elasticsearch-data-enrichment-with-logstash-a-few-security-examples) Windows server support. 6. [https://www.elastic.co/support/matrix](https://www.elastic.co/support/matrix) 7. [https://www.elastic.co/support/matrix#matrix\_os](https://www.elastic.co/support/matrix#matrix_os) What do you want to gain from X-Pack. I personally believe x-pack is cool, thus would recommend alerting, monitoring, security, and later on machine learning to do cool things find out a baseline for how many windows laptops you are collecting events from who's mac addresses were residing in one location on a given day the same day every week and send an alert when things start to look anomalous. 8. [https://www.elastic.co/products/x-pack](https://www.elastic.co/products/x-pack) Pricing here but also all the above is an insight to the depth of support you may get when you get a subscription with us 😄 9. [https://www.elastic.co/subscriptions](https://www.elastic.co/subscriptions) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 21, 2018, 5:42pm UTC](https://discuss.elastic.co/t/winlogbeat-logs-for-windows-7-10-and-x-pack/133134/3 "2018-06-21T17:42:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.