# Winlogbeat To Send All Windows Events

**URL:** <https://discuss.elastic.co/t/winlogbeat-to-send-all-windows-events/170805>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 4, 2019, 10:24pm UTC](https://discuss.elastic.co/t/winlogbeat-to-send-all-windows-events/170805 "2019-03-04T22:24:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [March 4, 2019, 10:24pm UTC](https://discuss.elastic.co/t/winlogbeat-to-send-all-windows-events/170805/1 "2019-03-04T22:24:10Z")

</div>

How or what is the best way to configure the Winlogbeat.yml file to send all Windows events? Thoughts?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 8, 2019, 2:26pm UTC](https://discuss.elastic.co/t/winlogbeat-to-send-all-windows-events/170805/2 "2019-03-08T14:26:25Z")

</div>

You could generate a config with all the channels.

> [@Use wildcards in Channels with Winlogbeat](https://discuss.elastic.co/t/use-wildcards-in-channels-with-winlogbeat/43367/2):
>
> There is no support for wildcards today. It's not too hard to generate the configuration file if you are using some kind of CM tool (like Ansible) to manage the installation and config. You could generate a one-off config using the script below. I agree the file does get big, but it's quite straight forward to manage. You know exactly what logs are going to be read. If wildcard support was added, I would want it to periodically check for new event logs. This is the one thing that you won't ge…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2019, 2:26pm UTC](https://discuss.elastic.co/t/winlogbeat-to-send-all-windows-events/170805/3 "2019-04-05T14:26:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.