# Better Stack Winlogbeat logging

## Start logging in 6 minutes

Collect logs from your Windows applications using [Winlogbeat](https://www.elastic.co/beats/winlogbeat).

Winlogbeat is specifically built to collect your Windows event logs and ship them to Better Stack.

### 1. Download and install Winlogbeat

Pick a version on [Winlogbeat download page](https://www.elastic.co/downloads/beats/winlogbeat) and install it.

### 2. Edit configuration

In your `winlogbeat.yml` file, **replace current `output.*` config** to send data to Better Stack:

```yaml
[label winlogbeat.yml output config]
output.elasticsearch:
  hosts: 'https://$INGESTING_HOST:443'
  path: '/elastic'
  headers:
    X-Better-Stack-Source-Token: '$SOURCE_TOKEN'
```

Review the rest of the config to **ensure some logs will be read**. For example, change `enabled: false` to `enabled: true` in the default `winlogbeat.event_logs` array.

You can read more about event log configuration in [Winlogbeat docs](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html).

### 3. Run Winlogbeat

Run Winlogbeat to load the configuration:

```powershell
[label Run in PowerShell]
winlogbeat.exe -c winlogbeat.yml
```

You should see your logs in [Better Stack → Live tail](https://telemetry.betterstack.com/team/0/tail ";_blank").

## Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏

## Additional information

Want to read about **Winlogbeat configuration** in more detail?
Check out the [Winlogbeat documentation](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuring-howto-winlogbeat.html).