# Filebeat IIS logs not sending all logs - how can I troubleshoot?

**URL:** https://discuss.elastic.co/t/filebeat-iis-logs-not-sending-all-logs-how-can-i-troubleshoot/157082
**Category:** Beats
**Tags:** filebeat
**Created:** [November 16, 2018, 2:28pm UTC](https://discuss.elastic.co/t/filebeat-iis-logs-not-sending-all-logs-how-can-i-troubleshoot/157082 "2018-11-16T14:28:41Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Brett\_Larson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brett_larson/32/37700_2.png) [@Brett\_Larson](https://discuss.elastic.co/u/Brett_Larson)
#### Post date: [November 16, 2018, 2:28pm UTC](https://discuss.elastic.co/t/filebeat-iis-logs-not-sending-all-logs-how-can-i-troubleshoot/157082/1 "2018-11-16T14:28:41Z")

</div>

Hello,  
We are in the process of moving from OMS to Elastic using the managed cloud. I have setup filebeat and the IIS module however i'm not seeing that logs are ingested at the same rate they are in OMS. There is in fact a huge discrepancy (around 4-5%) and i'm wondering how I can troubleshoot this further.

Below are the time periods and the log count for a specific computer, although this issue is occurring on multiple servers.

These are server 2012 R2 servers and they are having the issue when using both the 6.4.2 agents and the 6.5.0 agents.

4 hours  
OMS - 436,972  
Elastic - 18,400

24 hours  
OMS - 3,309,979  
Elastic - 181,488

1 week  
OMS - 33,375,125  
Elastic - 1,743,939

30 days  
OMS - 78,333,426  
Elastic - 8,997,271

Thank you!

---

<div class="post-metadata">

### Author: ![Brett\_Larson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brett_larson/32/37700_2.png) [@Brett\_Larson](https://discuss.elastic.co/u/Brett_Larson)
#### Post date: [November 20, 2018, 5:51am UTC](https://discuss.elastic.co/t/filebeat-iis-logs-not-sending-all-logs-how-can-i-troubleshoot/157082/2 "2018-11-20T05:51:44Z")

</div>

Just an update to answer my own question..

I believe the issue was that there were too many logs for the filebeat agent to deal with.. after waiting a few days it appears that it has finally caught up and the logs are processing successfully at least at the 4 hour time window between OMS and Elastic. 😄

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 18, 2018, 5:51am UTC](https://discuss.elastic.co/t/filebeat-iis-logs-not-sending-all-logs-how-can-i-troubleshoot/157082/3 "2018-12-18T05:51:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
