Winlogbeat 7.6 is installed on WEC. "ignore_older: 72h" is set.
If the events being forwarded have a date greater than the WEC server date and "ignore_older" is set, then such events will be ignored. Events from the future will be ignored.
Is it a bug, or am I doing something wrong?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.