# EVTX Import failure when EVTX contains a deleted entry

**URL:** <https://discuss.elastic.co/t/evtx-import-failure-when-evtx-contains-a-deleted-entry/203269>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 11, 2019, 4:17pm UTC](https://discuss.elastic.co/t/evtx-import-failure-when-evtx-contains-a-deleted-entry/203269 "2019-10-11T16:17:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dlebrun](https://avatars.discourse-cdn.com/v4/letter/d/f07891/32.png) [@dlebrun](https://discuss.elastic.co/u/dlebrun)\
**Post date:** [October 11, 2019, 4:17pm UTC](https://discuss.elastic.co/t/evtx-import-failure-when-evtx-contains-a-deleted-entry/203269/1 "2019-10-11T16:17:07Z")

</div>

When running Winlogbeat 7.4 from a PowerShell script to process EVTX files I am running into a problem specific to the number of records imported into Kibana. If the EVTX file contains no deleted entries, the script imports correctly.

However, when an EVTX contains a deleted entry, the number of files processed can vary greatly, and the variance is not equal to the number of deleted entries in the EVTX file. As an example, an EVTX containing 300,000 entries including 500 deleted entries can have 50,000 omitted entries.

THEORY: It is my suspicion that winlogbeat stops processing an EVTX file upn the first occurrence of a deleted entry (this has not been confirmed).

QUESTION: Is there any way that Winlogbeat can be configured to process an EVTX file containing deleted entries without failing when it hits a deleted entry?

---

<div class="post-metadata">

**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\
**Post date:** [October 21, 2019, 8:31am UTC](https://discuss.elastic.co/t/evtx-import-failure-when-evtx-contains-a-deleted-entry/203269/2 "2019-10-21T08:31:10Z")

</div>

Hi @dlebrun - how were the events deleted from the EVTX file? I hadn't thought that would happen usually.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2019, 8:31am UTC](https://discuss.elastic.co/t/evtx-import-failure-when-evtx-contains-a-deleted-entry/203269/3 "2019-11-18T08:31:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.