# A question about Winlogbeat configuration

**URL:** <https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [August 23, 2017, 10:25am UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050 "2017-08-23T10:25:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\
**Post date:** [August 23, 2017, 10:25am UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050/1 "2017-08-23T10:25:37Z")

</div>

Hello.  
If I like below diagram:  
Winlogbeat -\> Logstash -\> Elasticsearch -\> Kibana

Then in Winlogbeat configuration I must set both Logstash and Elasticsearch servers?

Thank you.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 23, 2017, 12:03pm UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050/2 "2017-08-23T12:03:13Z")

</div>

> [@hack3rcon](#):
>
> Winlogbeat -\> Logstash -\> Elasticsearch -\> Kibana

In that architecture you should configure Winlogbeat to output only to Logstash.

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\
**Post date:** [August 23, 2017, 12:14pm UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050/3 "2017-08-23T12:14:02Z")

</div>

If I enabled "Elasticsearch" then what's happened?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 23, 2017, 12:18pm UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050/4 "2017-08-23T12:18:31Z")

</div>

We don't recommend have two outputs enabled.

Winlogbeat will try to send the events directly to both Logstash and Elasticsearch. It requires a direct connection to both services. If one service goes down it will completely stop reporting events until it comes back up because it wants to guarantee at least once delivery to all outputs. Starting in 6.0 it does not allow you to have both outputs enabled at the same time.

---

<div class="post-metadata">

**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\
**Post date:** [August 23, 2017, 12:29pm UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050/5 "2017-08-23T12:29:30Z")

</div>

"Winlogbeat will try to send the events directly to both Logstash and Elasticsearch" !!!  
"Logstash and Elasticsearch" or "Logstash or Elasticsearch" ?  
Thus I must disable "Logstash" or "Elasticsearch" ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2017, 12:29pm UTC](https://discuss.elastic.co/t/a-question-about-winlogbeat-configuration/98050/6 "2017-09-20T12:29:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.