# How Logstash keeps track of winlogbeat events?

**URL:** <https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 13, 2017, 10:26pm UTC](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425 "2017-09-13T22:26:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [September 13, 2017, 10:26pm UTC](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425/1 "2017-09-13T22:26:08Z")

</div>

Hi,  
I am trying to use winlogbeat and Logstash. How does Logstash keep track of winlogbeat events if Logstash is restarted?

Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 14, 2017, 3:24pm UTC](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425/2 "2017-09-14T15:24:32Z")

</div>

Could you clarify what you mean by "keep track of"?

Logstash doesn't keep track of anything related to Winlogbeat when restarted. Winlogbeat sends events to Logstash and when Logstash has written the event to its in-memory queue it sends and ACK to Winlogbeat. After Winlogbeat receives the ACK it considers the event to have been successfully delivered and it will persist information about the last successful event to disk. This allows Winlogbeat to restart and resume from the last known read position.

If Logstash is restarted while there are events stored in the in-memory queue those events are lost. That's why Logstash has [persistent queues](https://www.elastic.co/guide/en/logstash/current/persistent-queues.html) that persist the events to disk before sending the ACK back to Winlogbeat. If you enable the persistent queue feature then on restart you can be sure that no events will be lost.

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [September 14, 2017, 5:17pm UTC](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425/3 "2017-09-14T17:17:36Z")

</div>

Thanks Andrew. What if I want to migrate from running Logstash from command line to Running Logstash as a service?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 14, 2017, 6:17pm UTC](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425/4 "2017-09-14T18:17:18Z")

</div>

It should just be a matter of putting the config file(s) in `/etc/logstash/conf.d` and [starting the service](https://www.elastic.co/guide/en/logstash/current/running-logstash.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2017, 6:17pm UTC](https://discuss.elastic.co/t/how-logstash-keeps-track-of-winlogbeat-events/100425/5 "2017-10-12T18:17:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.