# How far back in time does the Elastic Endpoint Security platform grab logs?

**URL:** <https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447>\
**Category:** Endpoint Security\
**Created:** [November 17, 2021, 12:15pm UTC](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447 "2021-11-17T12:15:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![geekzy](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@geekzy](https://discuss.elastic.co/u/geekzy)\
**Post date:** [November 17, 2021, 12:15pm UTC](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447/1 "2021-11-17T12:15:43Z")

</div>

We recently deployed elastic agent with endpoint security enabled across an environment and started seeing event logs from months prior to the agent being installed. This is brilliant from a visibility point of view, however as we rolled out the agents it led to a surge in events that meant we lost live events from other agents that were deployed as the stack could not keep up.

This made us curious, is there any reference to how far back the endpoint security agent grabs logs or any sort of configurable limit on the amount volume of logs that are exported from a single machine?

Thanks in advance,

---

<div class="post-metadata">

**Author:** ![Michelle\_Bennett](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michelle_bennett/32/96142_2.png) [@Michelle\_Bennett](https://discuss.elastic.co/u/Michelle_Bennett)\
**Post date:** [November 22, 2021, 10:32pm UTC](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447/2 "2021-11-22T22:32:45Z")

</div>

Hi geekzy,

From looking at the Endpoint code, is seems we collect future security events and none from past. Is it possible that you have installed the Windows integration along with Endpoint? Could you look at a few of the documents and see what the value of agent.type or possibly event.dataset is?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2021, 12:33am UTC](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447/3 "2021-12-21T00:33:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.