Are you sure that there is new data coming in that matches your filter? When you add filters like this Winlogbeat creates a query that it passes to Windows such that Windows only sends the matching events. For example, your Security log will use a query like:
<QueryList>
<Query Id="0">
<Select Path="Security">*[System[TimeCreated[timediff(@SystemTime) <= 172800000] and (EventID >= 500 and EventID <= 820) and (Level = 1 or Level = 2 or Level = 3 or Level = 0 or Level = 4)]]</Select>
</Query>
</QueryList>
I think that the actual range was the problem. It seems that I was using outdated information. It seems to work fine with other ranges. For example 4800-4803
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.