Better Stack Winlogbeat logging

Start logging in 6 minutes

Collect logs from your Windows applications using Winlogbeat.

Winlogbeat is specifically built to collect your Windows event logs and ship them to Better Stack.

1. Download and install Winlogbeat

Pick a version on Winlogbeat download page and install it.

2. Edit configuration

In your winlogbeat.yml file, replace current output.* config to send data to Better Stack:

output.elasticsearch:
  hosts: 'https://$INGESTING_HOST:443'
  path: '/elastic'
  headers:
    X-Better-Stack-Source-Token: '$SOURCE_TOKEN'

Review the rest of the config to ensure some logs will be read. For example, change enabled: false to enabled: true in the default winlogbeat.event_logs array.

You can read more about event log configuration in Winlogbeat docs.

3. Run Winlogbeat

Run Winlogbeat to load the configuration:

winlogbeat.exe -c winlogbeat.yml

You should see your logs in Better Stack → Live tail.

Need help?

Please let us know at hello@betterstack.com. We're happy to help! 🙏

Additional information

Want to read about Winlogbeat configuration in more detail? Check out the Winlogbeat documentation.