evtxtoelk

Evtxtoelk is a Python tool designed to efficiently load Windows Event Log (`.evtx`) files into Elasticsearch or export them as JSON lines for use with other data collectors. Key features include creating searchable documents with standardized fields based on the Elastic Common Schema, robust handling of corrupt records, and compatibility with recent Elasticsearch versions, enabling fast processing of large datasets using Rust-backed parsers. This tool is particularly useful for threat hunting in low-bandwidth environments where direct streaming is not feasible.