# Winlogbeat modules and file ingestion

**URL:** https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845
**Category:** Beats
**Tags:** beats-module, winlogbeat
**Created:** [October 15, 2021, 1:46pm UTC](https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845 "2021-10-15T13:46:34Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jane](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@jane](https://discuss.elastic.co/u/jane)
#### Post date: [October 15, 2021, 1:46pm UTC](https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845/1 "2021-10-15T13:46:34Z")

</div>

Hey,

Is it possible to apply Security, Sysmon and Powershell modules in winlogbeat.yml if I'm ingesting a file?  
I'm trying something like this, but it doesn't work 😕

```auto
winlogbeat.event_logs:
- name: "C:/LOGS/some_target.evtx"
  tags: [forwarded]
  processors:
    - script:
        when.equals.winlog.channel: Security
        lang: javascript
        id: security
        file: ${path.home}/module/security/config/winlogbeat-security.js
    - script:
        when.equals.winlog.channel: Microsoft-Windows-Sysmon/Operational
        lang: javascript
        id: sysmon
        file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

```

Any help would be appreciated )

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 12, 2021, 3:46pm UTC](https://discuss.elastic.co/t/winlogbeat-modules-and-file-ingestion/286845/2 "2021-11-12T15:46:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.