# Elastic Agent/Fleet - Winlog input missing security events

**URL:** <https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452>\
**Category:** Elasticsearch\
**Created:** [August 12, 2026, 11:48am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452 "2026-08-12T11:48:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen\_P](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephen_p/32/148031_2.png) [@Stephen\_P](https://discuss.elastic.co/u/Stephen_P)\
**Post date:** [August 12, 2026, 11:48am UTC](https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452/1 "2026-08-12T11:48:15Z")

</div>

Hey all

I'm working on deploying a Elastic stac POC but have hit a strange issue with collecting windows security event logs

**Environment**

- Elasticsearch/Kibana/Fleet Server: 9.5.1

- Tested Elastic Agent: 9.5.1 and 9.4.2

- Windows Server 2019 domain controller

- Agent installed as a Windows service running as `NT AUTHORITY\SYSTEM`

- Fleet System integration has Application, Security and System enabled

- Other Windows Event Logs are ingesting correctly (Application, System, PowerShell, Directory Service, DNS Server, Defender, etc.)

The problem is specifically i'm not seeing any "Security" event log data.

Running the following discover, I get no data

> host.name : "SERVERNAME" and data\_stream.dataset : "system.security"

I can confirm there are security event

> `Get-WinEvent -LogName Security -MaxEvents 10`

Fleet senders the stream correct and elastic agent seems to be working

> Starting to read from Security  
> Reading from Security  
> windows event log opened successfully

I've tested this on a couple of machine's which have similar outcomes, missing security events. standalone WinLogBeat works on the same server with a simple config

> winlogbeat.event\_logs:
> 
> - id: security-test  
> xml\_query: \>
> 
> \*

But this doesn't work

> winlogbeat.event\_logs:
> 
> - name: Security

Any suggestions where to go from here?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 12, 2026, 12:47pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452/2 "2026-08-12T12:47:07Z")

</div>

> [@Stephen\_P](#):
>
> host.name : "SERVERNAME" and data\_stream.dataset : "system.security"

Do you have data if you use the following query?

```auto
data_stream.dataset : "system.security" and host.os.platform : "windows" 

```