# HighVolume Hosts are dropping data
**URL:** https://discuss.elastic.co/t/highvolume-hosts-are-dropping-data/349582
**Category:** Beats
**Tags:** winlogbeat
**Created:** [December 18, 2023, 5:10pm UTC](https://discuss.elastic.co/t/highvolume-hosts-are-dropping-data/349582 "2023-12-18T17:10:44Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@JJ007](https://discuss.elastic.co/u/JJ007)
#### Post date: [December 18, 2023, 5:10pm UTC](https://discuss.elastic.co/t/highvolume-hosts-are-dropping-data/349582/1 "2023-12-18T17:10:44Z")
Hi,
We have certain high volume hosts that are sending data to EventHub via winlogbeat. These hosts are dropping some data and I dont see any indication of this in logs.
I see certain outputs.events.failed but dont see any outputs.events.dropped.
Are there any specific configurations are fine tuning that needs to be considered for high volume sources.
```auto
queue.mem:
events: 4096
flush.min_events: 2048
flush.timeout: 5s
output.kafka:
enabled: true
hosts: [xyz]
topic: "abct"
required_acks: 1
username: "$ConnectionString"
password: "123"
compression: none
ssl.enabled: true
partition.random:
reachable_only: false
keep_alive: 180000
channel_buffer_size: 512
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [January 2, 2024, 8:37pm UTC](https://discuss.elastic.co/t/highvolume-hosts-are-dropping-data/349582/2 "2024-01-02T20:37:15Z")
> [@JJ007](#):
>
> I see certain outputs.events.failed but dont see any outputs.events.dropped.
That means the events got retried and sent eventually according to [Understand metrics in Winlogbeat logs | Winlogbeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/understand-winlogbeat-logs.html)
> Note that failed events are not lost or dropped; they will be sent back to the publisher pipeline for retrying later.
What indication do you have of dropped data?
I would recommend turning on some additional metric logging with this config that can help with diagnosing.
```auto
# Read metrics from:
# curl http://localhost:6061/inputs/
# curl http://localhost:6061/stats
# curl http://localhost:6061/buffer
http:
host: localhost
port: 6061
buffer.enabled: true
pprof:
enabled: true
logging:
metrics:
namespaces: [stats, dataset]
```
> **[Event Processing Metrics | Winlogbeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/metrics-winlogbeat.html)**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 30, 2024, 10:37pm UTC](https://discuss.elastic.co/t/highvolume-hosts-are-dropping-data/349582/3 "2024-01-30T22:37:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.