# How to collect custom logs?
**URL:** https://community.graylog.org/t/how-to-collect-custom-logs/12094
**Category:** Graylog Central (peer support)
**Tags:** filebeat-windows, winlogbeat, sidecar
**Created:** [September 24, 2019, 4:54pm UTC](https://community.graylog.org/t/how-to-collect-custom-logs/12094 "2019-09-24T16:54:45Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@aleff616](https://community.graylog.org/u/aleff616)
#### Post date: [September 24, 2019, 4:54pm UTC](https://community.graylog.org/t/how-to-collect-custom-logs/12094/1 "2019-09-24T16:54:45Z")
Hi everyone, first of all thanks for your support my question is.
How can i collect logs from custom location in windows? for example, audit logs for MSSQL, or another application.
Here’s my actual config.
> # Needed for Graylog fields\_under\_root: true fields.collector\_node\_id: ${sidecar.nodeName} fields.gl2\_source\_collector: ${sidecar.nodeId}
>
> output.logstash:
> hosts: [“10.X.X.X:5044”]
> path:
> data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data
> logs: C:\Program Files\Graylog\sidecar\logs
> tags:
>
> - windows
> winlogbeat:
> event\_logs:
> - name: Application
> - name: System
> - name: Security
Thanks in advice
---
### Author:  [@x-wolverine-x](https://community.graylog.org/u/x-wolverine-x)
#### Post date: [September 24, 2019, 7:44pm UTC](https://community.graylog.org/t/how-to-collect-custom-logs/12094/2 "2019-09-24T19:44:52Z")
If you do not have the logs in the Windows events, you must use Filebeat or Nxlog.
Winlogbeat only supports Windows events. Your MSSQL server is able to log the Audit to the Windows events.
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [September 25, 2019, 6:07am UTC](https://community.graylog.org/t/how-to-collect-custom-logs/12094/3 "2019-09-25T06:07:57Z")
as winlogbeat is only getting the messages from windows event log, you need to configure filebeat to get specific logfiles.
---
### Author:  [@aleff616](https://community.graylog.org/u/aleff616)
#### Post date: [September 26, 2019, 9:57pm UTC](https://community.graylog.org/t/how-to-collect-custom-logs/12094/4 "2019-09-26T21:57:40Z")
thanks for the answer, i try to configure filebeat but without results.
this is my config
> # Needed for Graylog fields\_under\_root: true fields.collector\_node\_id: ${sidecar.nodeName} fields.gl2\_source\_collector: ${sidecar.nodeId}
>
> output.logstash:
> hosts: [“10.0.1.65:5044”]
> path:
> data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
> logs: C:\Program Files\Graylog\sidecar\logs
> tags:
>
> - windows
> filebeat.inputs:
> type: log
> enabled: true
> paths:
> - C:\ProgramData\Veeam\Endpoint\*log
and the logs
> 2019-09-26T16:56:03.187-0500 INFO instance/beat.go:544 Home path: [C:\Program Files\Graylog\sidecar] Config path: [C:\Program Files\Graylog\sidecar] Data path: [C:\Program Files\Graylog\sidecar\cache\filebeat\data] Logs path: [C:\Program Files\Graylog\sidecar\logs] 2019-09-26T16:56:03.203-0500 INFO instance/beat.go:551 Beat UUID: 3900d37a-da41-43dd-863e-93b0938caaa8 2019-09-26T16:56:03.203-0500 INFO [beat] instance/beat.go:768 Beat info {"system\_info": {"beat": {"path": {"config": "C:\\Program Files\\Graylog\\sidecar", "data": "C:\\Program Files\\Graylog\\sidecar\\cache\\filebeat\\data", "home": "C:\\Program Files\\Graylog\\sidecar", "logs": "C:\\Program Files\\Graylog\\sidecar\\logs"}, "type": "filebeat", "uuid": "3900d37a-da41-43dd-863e-93b0938caaa8"}}} 2019-09-26T16:56:03.203-0500 INFO [beat] instance/beat.go:777 Build info {"system\_info": {"build": {"commit": "e193f6d68b25b7ddbe3a3ed8d60bc07fea1ef800", "libbeat": "6.4.2", "time": "2018-09-26T12:41:59.000Z", "version": "6.4.2"}}} 2019-09-26T16:56:03.203-0500 INFO [beat] instance/beat.go:780 Go runtime info {"system\_info": {"go": {"os":"windows","arch":"amd64","max\_procs":4,"version":"go1.10.3"}}} 2019-09-26T16:56:03.214-0500 INFO [beat] instance/beat.go:784 Host info {"system\_info": {"host": {"architecture":"x86\_64","boot\_time":"2019-09-09T17:46:29.73-05:00","hostname":"SqlServer232","ips":["fe80::d60:3acc:e66d:6806/64","192.168.0.232/24","::1/128","127.0.0.1/8","fe80::5efe:c0a8:e8/128"],"kernel\_version":"6.3.9600.18589 (winblue\_ltsb.170204-0600)","mac\_addresses":["00:15:5d:07:59:1f","00:00:00:00:00:00:00:e0"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2012 R2 Standard","version":"6.3","major":3,"minor":0,"patch":0,"build":"9600.18619"},"timezone":"CDT","timezone\_offset\_sec":-18000,"id":"f893ae12-cf30-4934-8b44-4e24a91706d1"}}} 2019-09-26T16:56:03.214-0500 INFO instance/beat.go:273 Setup Beat: filebeat; Version: 6.4.2 2019-09-26T16:56:03.215-0500 INFO pipeline/module.go:98 Beat name: SqlServer232 2019-09-26T16:56:03.217-0500 ERROR instance/beat.go:743 Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [October 10, 2019, 10:08pm UTC](https://community.graylog.org/t/how-to-collect-custom-logs/12094/5 "2019-10-10T22:08:04Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.