# Delay betbeen timestamp and event.created on Winlogbeat

**URL:** <https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 20, 2021, 3:43pm UTC](https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182 "2021-07-20T15:43:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [July 20, 2021, 3:43pm UTC](https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182/1 "2021-07-20T15:43:42Z")

</div>

Hello!  
**The problem**  
We have unpredictable flating delay betbeen timestamp and event.created, when process logs with Winlogbeat.

**Background**  
We use WEF to send logs from Windows host to Windows log collector. Then we use winlogbeat to send logs to ELK through Kafka topic. So, the scheme is pretty standart:  
Win host -\> win collector-\> winlogbeat -\> kafka -\> logstash -\> Elastic.  
We have multiple collectors with same config. We use "Event Forwarding" channel to store collected events and it is near 15 Gb and store near 2 hours of logs.  
So, on two of them we have floating delay between timestamp and event.created more than an hour. (Max delay that i see is 1 hour 40 min, min is 1 sec). We monitors winlogbeat\collector load and it is near 30%(RAM, CPU). So, it is enough resources. EPS on that Winlogbeat is near 1200. So, it is not to much. I read all the logs, nothing interesting, only "successfully published 1024 events".  
We have another collector with 3000 EPS with same config.  
Can you please help with debugging that problem? Why winlogbeat may have 1.5 hour delay and it is ok for him?

**What we done** :

- Update Winlogbeat from 7.5.2 to latest 7.13.3
- Try to disable all anivirus related soft.
- Reboot
- set api [wineventlog-experimental](https://www.elastic.co/guide/en/beats/winlogbeat/master/configuration-winlogbeat-options.html#_event_logs_api)  
It doesn't help at all.

**Winlogbeat config** :

```auto
winlogbeat.event_logs:
  - name: ForwardedEvents
    forwarded: true
  - name: HardwareEvents
    forwarded: true
tags: ["winlog"]

queue.mem:
  events: 32736
  flush.min_events: 1024
  flush.timeout: 1s
  
#================================ Outputs =====================================
output.kafka:
  hosts: ["brokers"]
  topic: 'topic'
  username: "user"
  password: "${PASS}"
  max_message_bytes: 1000000

processors:
  - add_host_metadata: ~
xpack.monitoring:
    enabled: true
    elasticsearch:
        hosts: ["myhost:9200"]

```

Example of delay: 1 hour, 40 min.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/e/ae6158cf8d97a674c6a7e59178c4e0ffae1f4d24.png)  
Winlogbeat metrics on same time:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/9/19dd5090fec19a2d92af674cc2890c2cf275ffb2.png)  
Grafana metrics - 30-45% CPU (4 cores), 30-40% RAM (8 GB)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2021, 5:44pm UTC](https://discuss.elastic.co/t/delay-betbeen-timestamp-and-event-created-on-winlogbeat/279182/2 "2021-08-17T17:44:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.