[winlogbeat] where log data received from Linux_winlogbeat is stored

Elastic Stack Beats
1

I'm sending windows event logs to elasticsearch using winlogbeat.
And I'm using kibana to display the event log data received by elasticsearch.

So I have one question.
Where in the Linux directory is elasticsearch storing the event log data it receives from winlogbeat?

I think I can only see the result of analyzing the received event data when I check elasticsearch.log.
Therefore, I would like to know where in the elasticsearch directory the raw event log data received is stored.
Or is it not stored as such?

I'm waiting for help from someone with more experience.
Thank you in advance for your help.

2

Welcome to our community! :smiley:

Elasticsearch stores the data in /var/lib/elasticsearch, but it's not something you can just go and view. You need to use the Elasticsearch APIs or Kibana to view the data.

3

Your kind assist are very much appreciated. And, I was able to view the log stats in kibana. However, I would like to know where the original log data file in ubuntu directory. Do I need Elasticsearch APIs to view the original log files?I'm so in trouble waiting for your help

4

Winlogbeat won't read files from Ubuntu/linux.

Filebeat will and it depends on what modules you enable as to where it reads them from.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.