From our exchange server and active directory server securty events delay several hours to elasticsearch

security Events (winlogbeat 6.4.1) from exchange servers delay 2 hours and security Events from active directory servers delay 30min to elasticsearch (Kibana).

Does someone knows the reason? Or there is a bug with the winlogbeat Version 6.4.1?