# Send logs from Windows (Filebeat) to Graylog

**URL:** https://community.graylog.org/t/send-logs-from-windows-filebeat-to-graylog/10783
**Category:** Graylog Central (peer support)
**Tags:** filebeat-linux, nosendlogfblx, filebeat-windows, winlogbeat, sidecar
**Created:** [June 14, 2019, 7:21am UTC](https://community.graylog.org/t/send-logs-from-windows-filebeat-to-graylog/10783 "2019-06-14T07:21:20Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![deepaksharma171191](https://avatars.discourse-cdn.com/v4/letter/d/bbce88/32.png) [@deepaksharma171191](https://community.graylog.org/u/deepaksharma171191)
#### Post date: [June 14, 2019, 7:21am UTC](https://community.graylog.org/t/send-logs-from-windows-filebeat-to-graylog/10783/1 "2019-06-14T07:21:20Z")

</div>

HI Team,

I am looking for an option by which I can send logs from my Windows machine running Filebeat to my Graylog server running on different Linux machine. I had came across many options can you suggest which will be better option for future, if I grow with more number of Windows machine running Filebeat.  
I had setup Filebeat with some initial configurations and created input GELF TCP on Graylog.  
Kindly help me in providing right track.

---

<div class="post-metadata">

### Author: ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)
#### Post date: [June 14, 2019, 10:58am UTC](https://community.graylog.org/t/send-logs-from-windows-filebeat-to-graylog/10783/2 "2019-06-14T10:58:21Z")

</div>

if you run filebeat, you need a beats input on Graylog to receive the messages.

---

<div class="post-metadata">

### Author: ![deepaksharma171191](https://avatars.discourse-cdn.com/v4/letter/d/bbce88/32.png) [@deepaksharma171191](https://community.graylog.org/u/deepaksharma171191)
#### Post date: [June 14, 2019, 11:59am UTC](https://community.graylog.org/t/send-logs-from-windows-filebeat-to-graylog/10783/3 "2019-06-14T11:59:12Z")

</div>

Hi Jan,

Can you share the steps for direct Filebeat to Graylog setup (with some screenshots)?

And meanwhile I had setup the Graylog Sidecar on Windows machine and made the necessary configuration on Graylog as per link “[https://docs.graylog.org/en/3.0/pages/sidecar.html#sidecar-step-by-step](https://docs.graylog.org/en/3.0/pages/sidecar.html#sidecar-step-by-step)”, where configuration is using winlogbeat but I am not any data on Graylog and seeing this error in winlogbeat log file.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2c986cb9d1f5a927b528e7f8e9e0f0f803e0323b.png)  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7bc330ec2fd059474b9f1a99f22838f039ff4263.png)  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/54f925154acb4d79bc2150b9c997993acc3458cd.png)  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/bea9e5836c8b040e75d6e8c0e3ffe5a3e5cbe80e.png)

---

<div class="post-metadata">

### Author: ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)
#### Post date: [June 14, 2019, 4:22pm UTC](https://community.graylog.org/t/send-logs-from-windows-filebeat-to-graylog/10783/4 "2019-06-14T16:22:55Z")

</div>

What are your Log Collector (winlogbeat) settings? Asking because I didn’t see it…Also, under sidecar Administration, is the the configuration applied? It is interesting that in your sidecars overview the machine is called “graylog-sidecar” - the hostname should be there… Once it is connected the Graylog server will push the configuration down to the client into `c:\program files\Graylog\sidecar\generated\winlogbeat.conf` and you will also see winlogbeat.yml and meta.json in `C:\Program Files\Graylog\sidecar\cache\winlogbeat\data`

Here are some snaps from my config other than the ones you have posted…

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f6cbc148781aaaf72bde954e6af699814679c097.png)

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3623de8e1faa7102554ebc1a30e100904fb9d8f4.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [June 28, 2019, 4:23pm UTC](https://community.graylog.org/t/send-logs-from-windows-filebeat-to-graylog/10783/5 "2019-06-28T16:23:00Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.