# How to ignore bookmark(.winlogbeat.yml) when start the winlogbeat?

**URL:** <https://discuss.elastic.co/t/how-to-ignore-bookmark-winlogbeat-yml-when-start-the-winlogbeat/212787>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 22, 2019, 4:46pm UTC](https://discuss.elastic.co/t/how-to-ignore-bookmark-winlogbeat-yml-when-start-the-winlogbeat/212787 "2019-12-22T16:46:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![e997cd7e8d9915436150](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e997cd7e8d9915436150/32/40255_2.png) [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\
**Post date:** [December 22, 2019, 4:46pm UTC](https://discuss.elastic.co/t/how-to-ignore-bookmark-winlogbeat-yml-when-start-the-winlogbeat/212787/1 "2019-12-22T16:46:54Z")

</div>

Quick question.

How can I play one event log on repeat or loop?  
How to ignore bookmark when start the winlogbeat?  
And can i auto restart the winlogbeat when changed the winlogbeat.yml?

Thanks.🙂

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 3, 2020, 3:14am UTC](https://discuss.elastic.co/t/how-to-ignore-bookmark-winlogbeat-yml-when-start-the-winlogbeat/212787/2 "2020-01-03T03:14:12Z")

</div>

> [@e997cd7e8d9915436150](#):
>
> How can I play one event log on repeat or loop?

I think you would want to script the process. Like delete the registry file (.winlogbeat.yml), run winlogbeat until it reads the whole event log (use `no_more_events: stop` similar to how its mentioned in [reading .evtx files](https://www.elastic.co/guide/en/beats/winlogbeat/current/reading-from-evtx.html)). Then repeat that in a loop.

> [@e997cd7e8d9915436150](#):
>
> How to ignore bookmark when start the winlogbeat?

It will always try to use the bookmarks if they exist. You could change the registry\_path for each new run or just delete the file between runs.

> [@e997cd7e8d9915436150](#):
>
> And can i auto restart the winlogbeat when changed the winlogbeat.yml?

Winlogbeat doesn't have a config reloading feature that monitors the file for changes.

---

<div class="post-metadata">

**Author:** ![e997cd7e8d9915436150](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/e997cd7e8d9915436150/32/40255_2.png) [@e997cd7e8d9915436150](https://discuss.elastic.co/u/e997cd7e8d9915436150)\
**Post date:** [January 3, 2020, 4:41am UTC](https://discuss.elastic.co/t/how-to-ignore-bookmark-winlogbeat-yml-when-start-the-winlogbeat/212787/3 "2020-01-03T04:41:34Z")

</div>

I appreciate your help. Have a good day.🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2020, 4:41am UTC](https://discuss.elastic.co/t/how-to-ignore-bookmark-winlogbeat-yml-when-start-the-winlogbeat/212787/4 "2020-01-31T04:41:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.