# Event Caching? **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [November 30, 2017, 12:19am UTC](https://discuss.elastic.co/t/event-caching/109668 "2017-11-30T00:19:41Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![BrandonF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandonf/32/34032_2.png) [@BrandonF](https://discuss.elastic.co/u/BrandonF)\ **Post date:** [November 30, 2017, 12:19am UTC](https://discuss.elastic.co/t/event-caching/109668/1 "2017-11-30T00:19:41Z")
Brand new to beats and really loving it so far. Just getting starting with optimizations and am not seeing anything for any type of event caching. I see the parameters for retries on publishing events: _# The number of times to retry publishing an event after a publishing failure._ _# After the specified number of retries, the events are typically dropped._ _# Some Beats, such as Filebeat, ignore the max\_retries setting and retry until_ _# all events are published. Set max\_retries to a value less than 0 to retry_ _# until all events are published. The default is 3._ _#max\_retries: 3_ Is this the only available option here? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 30, 2017, 12:47am UTC](https://discuss.elastic.co/t/event-caching/109668/2 "2017-11-30T00:47:29Z")
Hi @BrandonF, what do you mean by event caching? What are you trying to optimize? A batch of events is read from the event log, stored in memory, sent to the output (it retries indefinitely until they delivered), then it repeats the cycle. ---
**Author:** ![Mazhar](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@Mazhar](https://discuss.elastic.co/u/Mazhar)\ **Post date:** [November 30, 2017, 6:52am UTC](https://discuss.elastic.co/t/event-caching/109668/3 "2017-11-30T06:52:56Z")
Hi @andrewkroh - I work with @BrandonF and let me clarify our request, - We wanted to check while processing the events (read from event log--\>store in memory) when my output link is not reached, where are the events which are read get stored? - While processing is there anything written on to local disk and its path Regards, Mazhar ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 30, 2017, 1:57pm UTC](https://discuss.elastic.co/t/event-caching/109668/4 "2017-11-30T13:57:40Z")
> [@Mazhar](#): > > where are the events which are read get stored? [In memory](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuring-internal-queue.html). > [@Mazhar](#): > > While processing is there anything written on to local disk and its path The [registry file](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#_literal_registry_file_literal) is updated after a batch of events has been successfully delivered to the output. The registry stores the last successfully delivered record\_number for each event log. ---
**Author:** ![BrandonF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandonf/32/34032_2.png) [@BrandonF](https://discuss.elastic.co/u/BrandonF)\ **Post date:** [November 30, 2017, 6:28pm UTC](https://discuss.elastic.co/t/event-caching/109668/5 "2017-11-30T18:28:27Z")
Thanks for the replies Andrew. With our previous connector architecture we were able to configure files (anywhere from 500MB to 10GB) that were held on disk that contained events when the destination was down/unreachable. Essentially giving us more time to recover without having to drop events, even if the Windows Event Logs started to roll over. Doesn't sound like this is an option with beats, but the closest configuration is to just set max\_retries to -1. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 30, 2017, 6:40pm UTC](https://discuss.elastic.co/t/event-caching/109668/6 "2017-11-30T18:40:06Z")
With Winlogbeat max\_retries is -1 already. The event logs are files on disk so they are basically a buffer. Whether Winlogbeat stores the events in a persistent queue on disk or the data is stored in the event logs doesn't make a huge difference. The amount of down time you can withstand without losing data is still limited by the amount of local diskspace available. So if you want to have more buffer to account for down time of an output you can increase the size of your event logs. We plan on add a disk-backed queue option to Beats sometime in the 6.x releases. So you will have this choice in the future. We want this for data sources that are not already on disk (like metrics). There is a persistent queue option [in Logstash](https://www.elastic.co/guide/en/logstash/current/persistent-queues.html) if you want to have a buffer between WLB and ES that you can rely on when ES is unavailable. ---
**Author:** ![BrandonF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandonf/32/34032_2.png) [@BrandonF](https://discuss.elastic.co/u/BrandonF)\ **Post date:** [November 30, 2017, 6:51pm UTC](https://discuss.elastic.co/t/event-caching/109668/7 "2017-11-30T18:51:35Z")
Really good info...Thank you! I had considered increasing the event logs in this situation. Looking forward to seeing what's to come in the new releases. Thanks again! ---
**Author:** ![BrandonF](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandonf/32/34032_2.png) [@BrandonF](https://discuss.elastic.co/u/BrandonF)\ **Post date:** [November 30, 2017, 6:57pm UTC](https://discuss.elastic.co/t/event-caching/109668/8 "2017-11-30T18:57:46Z")
Just wanted to point out, I'm running 5.x in our POC and unless it's changed in 6.x max retries is set at 3 for default. 🙂 ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 30, 2017, 7:06pm UTC](https://discuss.elastic.co/t/event-caching/109668/9 "2017-11-30T19:06:09Z")
Unless you are actually setting the value in your config file the behavior will be "[guaranteed](https://github.com/elastic/beats/blob/v5.6.0/winlogbeat/beater/winlogbeat.go#L228) delivery" where by it will continuously retry until success. The config file and [docs](https://www.elastic.co/guide/en/beats/winlogbeat/5.6/elasticsearch-output.html#_max_retries) could be more clear on this. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 28, 2017, 7:06pm UTC](https://discuss.elastic.co/t/event-caching/109668/10 "2017-12-28T19:06:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.