---
title: Windows event logs with Winlogbeat
description: Send Windows Event Viewer application, system, and security logs to Coralogix with Winlogbeat through your own Logstash instance.
url: https://coralogix.com/docs/integrations/files/windows-event-logs-with-winlogbeat/
product: ingress
feature: Logs Ingress
feature_id: logs.ingress
feature_identifier: ingress/logs.ingress
last_updated: '2026-10-29'
---

# Windows event logs with Winlogbeat

Coralogix integrates with [Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html) so you can send your Windows Event Viewer logs directly to Coralogix and parse them according to your needs.

## What you need

1. [Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html) installed on the Windows system to monitor.

2. A [Logstash](https://coralogix.com/docs/integrations/files/logstash.md) instance that you run in your own infrastructure, configured to receive Beats input and forward it to Coralogix. Coralogix no longer hosts a Logstash server for Beats shippers. See [Run your own Logstash instance](https://coralogix.com/docs/user-guides/latest-updates/deprecations/logstash.md#run-your-own-logstash-instance) for the Logstash input, filter, and output configuration.

**Private Key**: Your [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md) is a unique ID that represents your company.

**Application Name**: The name of your main application, for example, a company named "SuperData" would probably insert the "SuperData" string parameter, or if they would like to debug their test environment they might insert something like "SuperData-Test".

**Subsystem Name**: Your application probably has multiple Subsystems; for example: Backend-Servers, Middleware, Frontend-Servers, etc. Inserting the SubSystem Name facilitate your data's examination.

## Configuration

1. In this example `Winlogbeat` sends Application, System, and Security Windows logs to your own Logstash instance. Adjust this configuration file to match the address of your Logstash instance.

```
#=========================== Winlogbeat Event Logs ============================

winlogbeat.event_logs:

  - name: Application

    ignore_older: 72h



  - name: System



  - name: Security



#----------------------------- Logstash output --------------------------------

output.logstash:

    enabled: true

    hosts: ["<logstash-ip-address>:5044"]
```

Note

The Coralogix-hosted Logstash endpoints (`logstashserver.coralogix.com`, `logstash.coralogix.in`, `logstashserver.coralogix.us`) are retired and no longer accept data. See [Deprecation of Coralogix-hosted Logstash](https://coralogix.com/docs/user-guides/latest-updates/deprecations/logstash.md).

Set the Send-Your-Data API key, application name, and subsystem name in your Logstash configuration, not in `winlogbeat.yml`.

2. If you followed the Winlogbeat installation instructions earlier in this document, it should reside under:

```
C:\Program Files\Winlogbeat>
```

Make a backup copy of the default `winlogbeat.yml` file from the installation directory, then create a new `winlogbeat.yml` file using the code from step 1 above.

Modify this new configuration file as needed to suit your environment. Also copy the `winlogbeat.yml` file to the installation directory, which is the same directory where `winlogbeat.exe` resides.

3. To test the Winlogbeat configuration, open PowerShell in Administrator mode and issue the command:

```
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e
```

If you receive an error, write it down and contact Coralogix Support for assistance.

4. If the winlogbeat service is installed on the Windows device you want to monitor, type the following command from an Administrator's mode PowerShell session in the directory where the `install-service-winlogbeat.ps1` PowerShell script resides:

```
PS C:\Program Files\Winlogbeat> .\install-service-winlogbeat.ps1
```

5. Make sure your system is configured to run PowerShell scripts. If it is not, issue the following command from an Administrator's mode PowerShell session:

```
PS C:\Program Files\Winlogbeat> set-executionpolicy remotesigned
```

For more information, see the [Set-ExecutionPolicy documentation](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1).

6. Once the winlogbeat service is installed, start it from an Administrator's mode PowerShell session by issuing the command:

```
PS C:\Program Files\Winlogbeat> Start-Service winlogbeat
```

7. At this point, Windows Event Viewer logs stream to Coralogix. Verify them in [LiveTail](https://coralogix.com/docs/user-guides/data_exploration/logs/livetail.md).