# Winlogbeat to Logstash

**URL:** <https://discuss.elastic.co/t/winlogbeat-to-logstash/102890>\
**Category:** Logstash\
**Created:** [October 5, 2017, 6:21pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash/102890 "2017-10-05T18:21:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![p3y](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@p3y](https://discuss.elastic.co/u/p3y)\
**Post date:** [October 5, 2017, 6:21pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash/102890/1 "2017-10-05T18:21:18Z")

</div>

Hello,

I am very new to ELK technology. I am trying to push windows Event logs to the Logstash server but i am unable to do it. I am using this documentation:  
[https://www.elastic.co/guide/en/beats/winlogbeat/5.0/winlogbeat-getting-started.html](https://www.elastic.co/guide/en/beats/winlogbeat/5.0/winlogbeat-getting-started.html)  
[https://www.elastic.co/guide/en/beats/libbeat/5.0/logstash-installation.html#logstash-setup](https://www.elastic.co/guide/en/beats/libbeat/5.0/logstash-installation.html#logstash-setup)

Logstash config: No filter nothing.

```
input {
  beats {
    port => 5044
  }
}

# The filter part of this file is commented out to indicate that it is
# optional.
# filter {
#
# }

output {
  elasticsearch {
    hosts => "192.168.5.10:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

Winlogbeat winlogbeat.yml:

```
winlogbeat.event_logs:
  - name: Microsoft-Windows-Kerberos/Operational

output.logstash:
  # The Logstash hosts
  hosts: ["192.168.5.5:5044"]

```

The logstash service running properly.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/edf6767dd8651b8ac92cb92e3eebfbfdb7b2999a.png)

Now, on winlogbeat machine i have installed the winlogbeat service and it is running. How do i push the logs to logstash server? I know i am missing something but after spending 4+ hours i couldn't figure out. Please help

Winlogbeat version 5.6.2  
logstash version 5.6.2

Thanks in advance!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 5, 2017, 6:42pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash/102890/2 "2017-10-05T18:42:30Z")

</div>

Your configuration looks correct. If Winlogbeat is unable to send to Logstash it'll tell you about it in its log.

---

<div class="post-metadata">

**Author:** ![p3y](https://avatars.discourse-cdn.com/v4/letter/p/e495f1/32.png) [@p3y](https://discuss.elastic.co/u/p3y)\
**Post date:** [October 5, 2017, 7:06pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash/102890/3 "2017-10-05T19:06:26Z")

</div>

Winlogbeat logs Output:

```
2017-10-06T00:34:55+05:30 INFO Metrics logging every 30s
2017-10-06T00:34:55+05:30 INFO Home path: [C:\Program Files (x86)\winlogbeat] Config path: [C:\Program Files (x86)\winlogbeat] Data path: [C:\\ProgramData\\winlogbeat] Logs path: [C:\Program Files (x86)\winlogbeat\logs]
2017-10-06T00:34:55+05:30 INFO Setup Beat: winlogbeat; Version: 5.6.2
2017-10-06T00:34:55+05:30 INFO Max Retries set to: 3
2017-10-06T00:34:55+05:30 INFO Activated logstash as output plugin.
2017-10-06T00:34:55+05:30 INFO Publisher name: DESKTOP-UAIKJKO
2017-10-06T00:34:55+05:30 INFO Flush Interval set to: 1s
2017-10-06T00:34:55+05:30 INFO Max Bulk Size set to: 2048
2017-10-06T00:34:55+05:30 INFO State will be read from and persisted to C:\ProgramData\winlogbeat\.winlogbeat.yml
2017-10-06T00:34:55+05:30 INFO winlogbeat start running.
2017-10-06T00:35:25+05:30 INFO Non-zero metrics in the last 30s: uptime={"server_time":"2017-10-05T19:05:25.9456084Z","start_time":"2017-10-05T19:04:55.9132075Z","uptime":"30.0324009s","uptime_ms":"30032400"}
2017-10-06T00:35:55+05:30 INFO Non-zero metrics in the last 30s: uptime={"server_time":"2017-10-05T19:05:55.9449686Z","start_time":"2017-10-05T19:04:55.9132075Z","uptime":"1m0.0317611s","uptime_ms":"60031761"}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2017, 7:07pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash/102890/4 "2017-11-02T19:07:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.