# Agent (Winlogbeat) stop sending data

**URL:** <https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 10, 2026, 9:19am UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988 "2026-02-10T09:19:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andex](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Andex](https://discuss.elastic.co/u/Andex)\
**Post date:** [February 10, 2026, 9:19am UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988/1 "2026-02-10T09:19:31Z")

</div>

Hi, i’m facing with a problem for some winlogbeat agents. Randomly the agent stop sending data to the cluster. When i restart the service It starts writing data from where it stopped and then after a few hours it stops again.

Any suggests? I’m using basic config for winlogbeat.yml and i send data directly on Elasticsearch (mono-node cluster)

Thanks

---

<div class="post-metadata">

**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\
**Post date:** [February 10, 2026, 4:36pm UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988/2 "2026-02-10T16:36:00Z")

</div>

We’ve occasionally fixed issues that could cause this behavior. Are you running the latest version?  
What version of winlogbeat?  
Managed by fleet/agent or standalone?  
What version stack?

---

<div class="post-metadata">

**Author:** ![Andex](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Andex](https://discuss.elastic.co/u/Andex)\
**Post date:** [February 10, 2026, 4:59pm UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988/3 "2026-02-10T16:59:11Z")

</div>

Hello, thanks first of all

I’m running a standalone version.

My stack version is 8.19.10 (upgraded from 8.12)

Best regards

Andrea

---

<div class="post-metadata">

**Author:** ![Andex](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Andex](https://discuss.elastic.co/u/Andex)\
**Post date:** [February 23, 2026, 10:40am UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988/4 "2026-02-23T10:40:37Z")

</div>

@NickFritts Hi Nick

Any updates for this?

Thanks

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 23, 2026, 12:51pm UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988/5 "2026-02-23T12:51:56Z")

</div>

Please proved logs from WBeat, also check ES side, is there any trace why you lost connectivity?  
How many WB agents do you have? Are they all stop in the same time?

---

<div class="post-metadata">

**Author:** ![marc.guasch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc.guasch/32/74642_2.png) [@marc.guasch](https://discuss.elastic.co/u/marc.guasch)\
**Post date:** [February 23, 2026, 8:21pm UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988/6 "2026-02-23T20:21:41Z")

</div>

Hello! As requested by others, could you provide the configuration and logs for your setup ? (please anonymize them if required)

Also you mention that is an upgraded stack from 8.12, does this mean this behavior is new after upgrading, or was this happening before?