# Event log rate and indicators

**URL:** <https://discuss.elastic.co/t/event-log-rate-and-indicators/81608>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 7, 2017, 12:51pm UTC](https://discuss.elastic.co/t/event-log-rate-and-indicators/81608 "2017-04-07T12:51:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [April 7, 2017, 12:51pm UTC](https://discuss.elastic.co/t/event-log-rate-and-indicators/81608/1 "2017-04-07T12:51:54Z")

</div>

Hello, I'm about to install Winlogbeat on some of our production servers as part of testing Elastic Stack and I was wondering if Winlogbeat provides any indicator of not being able to keep up with the Windows event log message generation rate i.e. the event logs are generated so fast that Winlogbeat can't collect them quick enough.

I ask because in my previous job we used a proprietary SIEM solution and the agent would have trouble keeping up with the Domain Controller security log which was constantly thrashed - if it couldn't keep up there would be an alert on the console.

Is there anyway Winlogbeat will let me know if it can't keep up with the event log message rate?

Thanks.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 7, 2017, 1:21pm UTC](https://discuss.elastic.co/t/event-log-rate-and-indicators/81608/2 "2017-04-07T13:21:35Z")

</div>

There are no built in alerts. You could create a metric using Logstash that measures message lag. You could measure the difference in the time of receipt to the event creation time in Windows. Another thing you could look for is gaps in the record ID sequence for a given event log.

---

<div class="post-metadata">

**Author:** ![kernelpanic](https://avatars.discourse-cdn.com/v4/letter/k/c89c15/32.png) [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\
**Post date:** [April 7, 2017, 1:48pm UTC](https://discuss.elastic.co/t/event-log-rate-and-indicators/81608/3 "2017-04-07T13:48:12Z")

</div>

Thankyou very much, Logstash metrics seems to be the way to do it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2017, 1:58pm UTC](https://discuss.elastic.co/t/event-log-rate-and-indicators/81608/4 "2017-05-05T13:58:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.