Agent (Winlogbeat) stop sending data

Elastic Stack Beats
1

Hi, i’m facing with a problem for some winlogbeat agents. Randomly the agent stop sending data to the cluster. When i restart the service It starts writing data from where it stopped and then after a few hours it stops again.

Any suggests? I’m using basic config for winlogbeat.yml and i send data directly on Elasticsearch (mono-node cluster)

Thanks

2

We’ve occasionally fixed issues that could cause this behavior. Are you running the latest version?
What version of winlogbeat?
Managed by fleet/agent or standalone?
What version stack?

3

Hello, thanks first of all

I’m running a standalone version.

My stack version is 8.19.10 (upgraded from 8.12)

Best regards

Andrea

4

@NickFritts Hi Nick

Any updates for this?

Thanks

5

Please proved logs from WBeat, also check ES side, is there any trace why you lost connectivity?
How many WB agents do you have? Are they all stop in the same time?

6

Hello! As requested by others, could you provide the configuration and logs for your setup ? (please anonymize them if required)

Also you mention that is an upgraded stack from 8.12, does this mean this behavior is new after upgrading, or was this happening before?