# \[winlogbeat\] where log data received from Linux\_winlogbeat is stored

**URL:** <https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 4, 2022, 8:47am UTC](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174 "2022-11-04T08:47:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shaAbe](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@shaAbe](https://discuss.elastic.co/u/shaAbe)\
**Post date:** [November 4, 2022, 8:47am UTC](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174/1 "2022-11-04T08:47:34Z")

</div>

I'm sending windows event logs to elasticsearch using winlogbeat.  
And I'm using kibana to display the event log data received by elasticsearch.

So I have one question.  
Where in the Linux directory is elasticsearch storing the event log data it receives from winlogbeat?

I think I can only see the result of analyzing the received event data when I check elasticsearch.log.  
Therefore, I would like to know where in the elasticsearch directory the raw event log data received is stored.  
Or is it not stored as such?

I'm waiting for help from someone with more experience.  
Thank you in advance for your help.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 4, 2022, 9:09am UTC](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174/2 "2022-11-04T09:09:51Z")

</div>

Welcome to our community! 😃

Elasticsearch stores the data in `/var/lib/elasticsearch`, but it's not something you can just go and view. You need to use the Elasticsearch APIs or Kibana to view the data.

---

<div class="post-metadata">

**Author:** ![shaAbe](https://avatars.discourse-cdn.com/v4/letter/s/958977/32.png) [@shaAbe](https://discuss.elastic.co/u/shaAbe)\
**Post date:** [November 10, 2022, 8:45am UTC](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174/3 "2022-11-10T08:45:53Z")

</div>

Your kind assist are very much appreciated. And, I was able to view the log stats in kibana. However, I would like to know where the original log data file in ubuntu directory. Do I need Elasticsearch APIs to view the original log files?I'm so in trouble waiting for your help

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 13, 2022, 11:33pm UTC](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174/4 "2022-11-13T23:33:21Z")

</div>

Winlogbeat won't read files from Ubuntu/linux.

Filebeat will and it depends on what modules you enable as to where it reads them from.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2022, 1:33am UTC](https://discuss.elastic.co/t/winlogbeat-where-log-data-received-from-linux-winlogbeat-is-stored/318174/5 "2022-12-12T01:33:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.