# Windows events to graylog server

**URL:** <https://community.graylog.org/t/windows-events-to-graylog-server/8007>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, filebeat-windows, winlogbeat\
**Created:** [December 12, 2018, 7:45pm UTC](https://community.graylog.org/t/windows-events-to-graylog-server/8007 "2018-12-12T19:45:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![np97190](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/np97190/32/3466_2.png) [@np97190](https://community.graylog.org/u/np97190)\
**Post date:** [December 12, 2018, 7:45pm UTC](https://community.graylog.org/t/windows-events-to-graylog-server/8007/1 "2018-12-12T19:45:54Z")

</div>

HI,

I am new to graylog and I have tried setting up sidecar with winlogbeat which seems to be configured properly, but I am not receiving events in graylog. Here are the details -

Global Input-  
 ![Global_Input](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/154c7aaac9b86879bf11f7808c5e9cbd78402aad.png)

Winlogbeat.yml

```
fields:
  collector_node_id: graylog-collector-sidecar
  gl2_source_collector: 429cfebb-462b-45b9-9082-ee958656cb5e
output:
  logstash:
hosts:
- XX.XX.XX.X:5044
path:
  data: C:\Program Files\graylog\collector-sidecar\cache\winlogbeat\data
  logs: C:\Program Files\graylog\collector-sidecar\logs
tags:
- windows
winlogbeat:
  event_logs:
  - name: Application
  - name: System
  - name: Security

```

I could see `EventLog[System] successfully published 1 events` log entry in winlogbeat log file but in graylog web UI there is no data under search tab.

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [December 13, 2018, 6:51am UTC](https://community.graylog.org/t/windows-events-to-graylog-server/8007/2 "2018-12-13T06:51:36Z")

</div>

First order of business is: did you handwrite the `winlogbeat.yml` file? Or was it generated by Graylog? Because it’s the latter that needs to be done. When using the Sidecar, you don’t manually manage BEATS.

Funnily enough we just had a discussion about setting up the Sidecar over here:

> [@Filebeat config not found. Tags - no config found](https://community.graylog.org/t/filebeat-config-not-found-tags-no-config-found/7986/):
>
> I see that this topic has been covered a couple of times. And in each time I go through thread I replicate the solutions/checks and still have this issue. a) Is it normal for file = /etc/graylog/collector-sidecar/generated/filebeat.yml to be missing after installing collector-sidecar 0.1.6? Is it OK if I take filebeat config from forum and customize it. Then replace the missing filebeat.yml? b) My config for tags is as below. The tags show in Graylog 2.4 appliance I am using for demo. Does thi…

---

<div class="post-metadata">

**Author:** ![np97190](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/np97190/32/3466_2.png) [@np97190](https://community.graylog.org/u/np97190)\
**Post date:** [December 13, 2018, 8:51am UTC](https://community.graylog.org/t/windows-events-to-graylog-server/8007/3 "2018-12-13T08:51:00Z")

</div>

Thanks for the response

winlogbeat.yml was created automatically when configuration was created in graylog.

I found out that the problem is with Graylog server. I pointed windows collector to other graylog server and it is sending logs to server.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 27, 2018, 8:51am UTC](https://community.graylog.org/t/windows-events-to-graylog-server/8007/4 "2018-12-27T08:51:02Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.