# EventID 4801 and 4800 are not getting visualised in Kibana through Winlogbeat **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [October 30, 2018, 10:43am UTC](https://discuss.elastic.co/t/eventid-4801-and-4800-are-not-getting-visualised-in-kibana-through-winlogbeat/154625 "2018-10-30T10:43:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![SunilT](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@SunilT](https://discuss.elastic.co/u/SunilT)\ **Post date:** [October 30, 2018, 10:43am UTC](https://discuss.elastic.co/t/eventid-4801-and-4800-are-not-getting-visualised-in-kibana-through-winlogbeat/154625/1 "2018-10-30T10:43:53Z")
I have configured the winlogbeat.yml file to take EventID:4801,4800,4624,4625, but when I am checking on Kibana, it is showing me logs of EventID:4625 and 4624. No logs are getting generated for EventId: 4800 and 4801. I have attached the Kibana visualisation and screenshot of my winlogbeat.yml file. ![pic2](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e36211fe19d47d1704af7399580fd48bc76b2f1c.png) ![pic1|690x387] (upload://jD1mG7pRUhsefFedTOKpeBE0bhE.png) ![pic1](https://us1.discourse-cdn.com/elastic/original/3X/8/9/89928943e8da8f879896afbbcbd135ced542d052.png) ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [October 30, 2018, 6:50pm UTC](https://discuss.elastic.co/t/eventid-4801-and-4800-are-not-getting-visualised-in-kibana-through-winlogbeat/154625/2 "2018-10-30T18:50:54Z")
Hi, Which version of Windows are you running? Do you see those events in Event Viewer? If so, please share the debug logs of winlogbeat (`-d *` option) ---
**Author:** ![SunilT](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@SunilT](https://discuss.elastic.co/u/SunilT)\ **Post date:** [October 31, 2018, 5:58am UTC](https://discuss.elastic.co/t/eventid-4801-and-4800-are-not-getting-visualised-in-kibana-through-winlogbeat/154625/3 "2018-10-31T05:58:06Z")
Hi Adrain, I am using windows 10. Yeah i am able to see those events in event viewer. Could you please tell me how to get the debug log? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [October 31, 2018, 6:28pm UTC](https://discuss.elastic.co/t/eventid-4801-and-4800-are-not-getting-visualised-in-kibana-through-winlogbeat/154625/4 "2018-10-31T18:28:03Z")
See the following options: [https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-logging.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-logging.html) Use debug log level: ```auto logging.level: debug ``` And paste your logs or share via private message. Thanks ---
**Author:** ![SunilT](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@SunilT](https://discuss.elastic.co/u/SunilT)\ **Post date:** [November 1, 2018, 6:38am UTC](https://discuss.elastic.co/t/eventid-4801-and-4800-are-not-getting-visualised-in-kibana-through-winlogbeat/154625/5 "2018-11-01T06:38:18Z")
thanks, from past two days I am getting the event logs generated for those EventIDs(4801 and 4800) and are getting visualised in my local machine. I tried to send it to remote server, and as well as to my local machine. But that event is not getting generated in remote server but coming successfully in my local machine. Could you tell me why, and what should be done. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 29, 2018, 6:38am UTC](https://discuss.elastic.co/t/eventid-4801-and-4800-are-not-getting-visualised-in-kibana-through-winlogbeat/154625/6 "2018-11-29T06:38:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.