# Winlogbeat.yml should specify the "api" attribute is available
**URL:** https://discuss.elastic.co/t/winlogbeat-yml-should-specify-the-api-attribute-is-available/77079
**Category:** Beats
**Tags:** winlogbeat
**Created:** [March 2, 2017, 3:10am UTC](https://discuss.elastic.co/t/winlogbeat-yml-should-specify-the-api-attribute-is-available/77079 "2017-03-02T03:10:16Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@procule](https://discuss.elastic.co/u/procule)
#### Post date: [March 2, 2017, 3:10am UTC](https://discuss.elastic.co/t/winlogbeat-yml-should-specify-the-api-attribute-is-available/77079/1 "2017-03-02T03:10:16Z")
Hi,
After two days of attempting to change the code of Winlogbeat to access the logs of a remote SAN integrating the Windows Event Log API, I realized that the SAN was using the old "eventlogging" API.
While trying to integrate the old "eventlogging" API, I found out that in the "winlogbeat/eventlog/factory.go" file, there are keys to specify which API you want to use: "eventlog" and "eventlogging", which are the old API and the "new" API.
After adding that in "winlogbeat.yml", I succeeded to received the logs:
```
winlogbeat.event_logs:
- name: Security
api: eventlogging
```
However, I had to change the code in "eventlogging.go" to add the option to use "OpenEventLog" for remote logs. I will create another topic about that.
O.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 30, 2017, 3:10am UTC](https://discuss.elastic.co/t/winlogbeat-yml-should-specify-the-api-attribute-is-available/77079/2 "2017-03-30T03:10:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.