# Elasticsearch not receiving ForwardedEvents

**URL:** <https://discuss.elastic.co/t/elasticsearch-not-receiving-forwardedevents/175507>\
**Category:** Beats\
**Created:** [April 5, 2019, 4:21am UTC](https://discuss.elastic.co/t/elasticsearch-not-receiving-forwardedevents/175507 "2019-04-05T04:21:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [April 5, 2019, 4:21am UTC](https://discuss.elastic.co/t/elasticsearch-not-receiving-forwardedevents/175507/1 "2019-04-05T04:21:17Z")

</div>

Collector on Server 2016 and ElasticStack 6.7  
All events appear to be coming into the ForwardedEvents on the Collector, all that seems to work OK.

And I know it's coming through the logstash pipe because it set up my index which I have configured in conf.d.   
winlogbeat-2019.14

I've got winlogbeat.yml set up like this -

```
winlogbeat.event_logs:
  - name: ForwardedEvents
    ignore_older: 2h
 # event_id: 4688, 5156 
# ignore_older: 2h
  - name: Security
    event_id: 4633, 4688, 4657, 5156
  - name: Microsoft-Windows-Powershell/Operational
    event_id: 4103, 4104
  - name: Microsoft-Windows-WMI-Activity/Operational
    event_id: 5857, 5859, 5860, 5861

```

The events for the local Collector are going to the elasticstack BUT I'm not getting ANY of the forwarded events or events that come INTO the Collector...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bfacba2e7abb7a203baf405dbb6c97faf9126240.png)

Hope that makes sense, really strange I've set up about 10 elasticstacks and never had this problem.

Appreciate any thoughts, thanks!!

---

<div class="post-metadata">

**Author:** ![mathurin68](https://avatars.discourse-cdn.com/v4/letter/m/6bbea6/32.png) [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Post date:** [April 6, 2019, 6:48pm UTC](https://discuss.elastic.co/t/elasticsearch-not-receiving-forwardedevents/175507/3 "2019-04-06T18:48:44Z")

</div>

Lack of sleep over the last few days... no idea what I was doing wrong but it's working now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2019, 8:48pm UTC](https://discuss.elastic.co/t/elasticsearch-not-receiving-forwardedevents/175507/4 "2019-05-04T20:48:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.