# Winlogbeat not pushing logs to elastic

**URL:** <https://discuss.elastic.co/t/winlogbeat-not-pushing-logs-to-elastic/330014>\
**Category:** Elasticsearch\
**Created:** [April 14, 2023, 1:20pm UTC](https://discuss.elastic.co/t/winlogbeat-not-pushing-logs-to-elastic/330014 "2023-04-14T13:20:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ben\_C8400](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ben_c8400/32/119830_2.png) [@Ben\_C8400](https://discuss.elastic.co/u/Ben_C8400)\
**Post date:** [April 14, 2023, 1:20pm UTC](https://discuss.elastic.co/t/winlogbeat-not-pushing-logs-to-elastic/330014/1 "2023-04-14T13:20:16Z")

</div>

Hi all,

I've been trying to setup winlogbeat, but have had no success so far.  
After running the script i get following result, not giving any errors.  
On Kibana it actually shows the index template, and the dashboards are also loaded.  
But when I select "winlogbeat-\*" in discover, it shows no logs.

I'm trying to push directly to Elastic, not through Logstash  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5919fdada6d40fefef69c2ad23aa2eb48cece9c.png)

Here is my .yml file:

```auto
###################### Winlogbeat Configuration Example ########################

# ================================= Dashboards =================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here or by using the `setup` command.
setup.dashboards.enabled: true

# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:
  setup.ilm.overwrite: true
  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: " ***:***"
  username: "***"
  password: "***"

  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
  #space.id:

# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: [" ***:***"]

  # Protocol - either `http` (default) or `https`.
  #protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "***"
  password: "***"

  # Pipeline to route events to security, sysmon, or powershell pipelines.
  pipeline: "winlogbeat-%{[agent.version]}-routing"

# ------------------------------ Logstash Output -------------------------------
#output.logstash:
  # The Logstash hosts
  #hosts: [" ***:***"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

```

I've left out the parts of the yml where I didn't change anything.  
Can anyone help me why I'm not pushing my events? They're all collecting in the event viewer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2023, 1:20pm UTC](https://discuss.elastic.co/t/winlogbeat-not-pushing-logs-to-elastic/330014/2 "2023-05-12T13:20:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.