# Import evtx-files from a directory to graylog **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** sidecar, nxlog, filebeat-windows, winlogbeat\ **Created:** [June 16, 2023, 12:13pm UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196 "2023-06-16T12:13:06Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![itsjstin](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@itsjstin](https://community.graylog.org/u/itsjstin)\ **Post date:** [June 16, 2023, 12:13pm UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/1 "2023-06-16T12:13:06Z")
Hello guys, I want to configure graylog sidecar to import WIndows-Event-Logs from a directory to graylog. Is it possible to use nxlog, filebeat or winlogbeat to import these logs? I tried some different configs but I dont get it. Maybe there is someone who already did finish the import with one of those tools. Thank you! ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [June 16, 2023, 12:47pm UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/2 "2023-06-16T12:47:17Z")
Do you mean already exported windows events like evtx files? ---
**Author:** ![itsjstin](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@itsjstin](https://community.graylog.org/u/itsjstin)\ **Post date:** [June 16, 2023, 1:06pm UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/3 "2023-06-16T13:06:37Z")
Yes, exactly Many evtx-files in a directory ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [June 16, 2023, 1:28pm UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/4 "2023-06-16T13:28:34Z")
This article is about doing it into ELK but most of the steps about the client side steps are the same, just make sure your winlogbeat config is set to output to Graylog [Manually upload EVTX log files to ELK with Winlogbeat and PowerShell – Burnham Forensics](https://burnhamforensics.com/2019/11/19/manually-upload-evtx-log-files-to-elk-with-winlogbeat-and-powershell/) ---
**Author:** ![itsjstin](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@itsjstin](https://community.graylog.org/u/itsjstin)\ **Post date:** [June 16, 2023, 1:41pm UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/5 "2023-06-16T13:41:14Z")
Alright, thank you, I will try that. The only problem is that I want to automize it. For example: I put new files in the directory and they are automatically imported to Graylog without using a powershell script. ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [June 16, 2023, 1:59pm UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/6 "2023-06-16T13:59:41Z")
This may be helpful [Not sure how to read from .evtx files | Winlogbeat Reference [8.8] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html) or just put the powershell on a schedule and change it to clean up files it already processed to another folder etc. ---
**Author:** ![itsjstin](https://avatars.discourse-cdn.com/v4/letter/i/a87d85/32.png) [@itsjstin](https://community.graylog.org/u/itsjstin)\ **Post date:** [June 17, 2023, 10:55am UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/7 "2023-06-17T10:55:35Z")
Okay, that sounds good. But is it possbile with mutliple evtx-flies at once? ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [June 18, 2023, 12:31am UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/8 "2023-06-18T00:31:38Z")
I dont know of a way to have it process mutliple evtx at once, but it will import them very fast. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [July 2, 2023, 12:32am UTC](https://community.graylog.org/t/import-evtx-files-from-a-directory-to-graylog/29196/9 "2023-07-02T00:32:03Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.