Winlogbeat vs Filebeat

Elastic Stack Beats
1

Hi,

Filebeat and Winlogbeat seem to work similarly. Both beats seem to be able to process logs from Windows (in the case of Filebeats, it can also process logs from other OS). My questions would be:

1- Which beat is better to process Windows logs?
2- What advantages does one have over the other?
3- For some reason, would it be worth installing both beats to process Windows logs?

Thank you

1 Like
2
  1. Files on the file system = filebeat, windows events = winlogbeat
  2. Filebeat is agnostic and can process any file. Winlogbeat will only pull logs from the event logger
  3. Yep, depends on if it's a file or not (as per above)
1 Like
3

Thank you @warkolm. Your easy explanation clears the doubts I had. I'm going to test both beats and determine if I should use both or just one of them.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.