# Sending Windows Logs to GrayLog

**URL:** <https://community.graylog.org/t/sending-windows-logs-to-graylog/20583>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, winlogbeat\
**Created:** [July 21, 2021, 1:42pm UTC](https://community.graylog.org/t/sending-windows-logs-to-graylog/20583 "2021-07-21T13:42:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgajjar](https://avatars.discourse-cdn.com/v4/letter/m/6a8cbe/32.png) [@mgajjar](https://community.graylog.org/u/mgajjar)\
**Post date:** [July 21, 2021, 1:42pm UTC](https://community.graylog.org/t/sending-windows-logs-to-graylog/20583/1 "2021-07-21T13:42:45Z")

</div>

I have a GrayLog server running on Ubuntu 20.04 Server. I want to monitor Windows logs through that. My question is how to configure graylog to recieve windows logs.

I have installed Winlogbeat on windows machine and below is the configuration. I do not see any messages on GrayLog. I configured Beats Input on Graylog. Is there something missing or wrong in the winlogbeat configuration?

winlogbeat.event\_logs:

- name: System
- name: Security
- name: ForwardedEvents  
tags: [forwarded]

output.logstash:

# The Logstash hosts

hosts: [“192.192.168.10.5:515”]

processors:

- add\_host\_metadata:  
when.not.contains.tags: forwarded
- add\_cloud\_metadata: ~

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [July 21, 2021, 2:09pm UTC](https://community.graylog.org/t/sending-windows-logs-to-graylog/20583/2 "2021-07-21T14:09:39Z")

</div>

Are you installing just winlogbeats on the windows machines? It is much preferable to install Sidecar (which includes winlogbeats) from [here](https://github.com/Graylog2/collector-sidecar/releases)…

From there, in short, create the input, modify the sidecar configuration on the windows machine so it sees the Graylog server, create a log collector on the Graylog server, create a configuration based on the collector, then apply the configuration to the windows machine that should show up in the system/sidecars/administration list. (from memory)

Detail on configuration is here: [Graylog Sidecar — Graylog 4.1.0 documentation](https://docs.graylog.org/en/latest/pages/sidecar.html)

If you are still having problems, It is helpful to post your configuration code (windows sidecar configuration, Graylog log collector, Collector Configuration, plus any errors) be as specific as possible.

please use the forum tools ( such as `</>`) to make the code readable.

---

<div class="post-metadata">

**Author:** ![mgajjar](https://avatars.discourse-cdn.com/v4/letter/m/6a8cbe/32.png) [@mgajjar](https://community.graylog.org/u/mgajjar)\
**Post date:** [July 21, 2021, 2:14pm UTC](https://community.graylog.org/t/sending-windows-logs-to-graylog/20583/3 "2021-07-21T14:14:06Z")

</div>

Yes I only installed Winlogbeats. I will try with sidecar as you explained. Thanks for the help/

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 4, 2021, 2:14pm UTC](https://community.graylog.org/t/sending-windows-logs-to-graylog/20583/4 "2021-08-04T14:14:12Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.