# Incomplete data transfer on winlogbeat 7.16.1 **URL:** https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607 **Category:** Beats **Tags:** winlogbeat **Created:** [January 6, 2022, 3:27am UTC](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607 "2022-01-06T03:27:01Z") **Posts on this page:** 4 **Page:** 1
### Author: ![Frank\_Kuo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_kuo/32/90467_2.png) [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo) #### Post date: [January 6, 2022, 3:27am UTC](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607/1 "2022-01-06T03:27:01Z")
hi, We upgraded ELK clusters to v7.16.1 on 2021/12/21. (winlogbeat v7.4.2) Everything is fine. And our AD servers updated patch 'KB5008218' on 2021/21/27. Winlogbeat transferred incomplete data to logstash! Our windows server generate 10,000,000 records but winlogbeat sent 5,000 records only. We have upgraded winlogbeat to 7.16.1 but it still not working. winlogbeat yml: ```auto winlogbeat.event_logs: - name: Security event_id: 4624-6280 processors: - script: lang: javascript id: security file: ${path.home}/module/security/config/winlogbeat-security.js - name: System level: critical, error, warning output.logstash: hosts: ["Logstash:5045"] setup.kibana: host: "Kibana:5601" ``` winlogbeat log: ```auto 2022-01-06T10:15:55.457+0800 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":437,"time":{"ms":437}},"total":{"ticks":3296,"time":{"ms":3296},"value":3296},"user":{"ticks":2859,"time":{"ms":2859}}},"handles":{"open":254},"info":{"ephemeral_id":"4bf426fc-501f-437c-8e1f-d2c06df67f0d","uptime":{"ms":36131},"version":"7.16.1"},"memstats":{"gc_next":81807504,"memory_alloc":43981472,"memory_sys":85943960,"memory_total":324528656,"rss":111345664},"runtime":{"goroutines":26}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":3300,"batches":3,"total":3300},"read":{"bytes":30},"type":"logstash","write":{"bytes":1007152}},"pipeline":{"clients":1,"events":{"active":4117,"published":4116,"retry":1100,"total":4117},"queue":{"max_events":4096}}},"system":{"cpu":{"cores":4}}}}} 2022-01-06T10:16:25.459+0800 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":468,"time":{"ms":31}},"total":{"ticks":3327,"time":{"ms":31},"value":3327},"user":{"ticks":2859}},"handles":{"open":254},"info":{"ephemeral_id":"4bf426fc-501f-437c-8e1f-d2c06df67f0d","uptime":{"ms":66132},"version":"7.16.1"},"memstats":{"gc_next":81807504,"memory_alloc":44141112,"memory_total":324688296,"rss":111390720},"runtime":{"goroutines":26}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":3300},"read":{"bytes":36}},"pipeline":{"clients":1,"events":{"active":4117}}}}}} 2022-01-06T10:16:55.462+0800 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":531,"time":{"ms":63}},"total":{"ticks":3406,"time":{"ms":79},"value":3406},"user":{"ticks":2875,"time":{"ms":16}}},"handles":{"open":256},"info":{"ephemeral_id":"4bf426fc-501f-437c-8e1f-d2c06df67f0d","uptime":{"ms":96134},"version":"7.16.1"},"memstats":{"gc_next":81807504,"memory_alloc":44303328,"memory_total":324850512,"rss":111435776},"runtime":{"goroutines":26}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":3300},"read":{"bytes":36}},"pipeline":{"clients":1,"events":{"active":4117}}}}}} 2022-01-06T10:17:25.459+0800 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":593,"time":{"ms":62}},"total":{"ticks":3483,"time":{"ms":77},"value":3483},"user":{"ticks":2890,"time":{"ms":15}}},"handles":{"open":258},"info":{"ephemeral_id":"4bf426fc-501f-437c-8e1f-d2c06df67f0d","uptime":{"ms":126132},"version":"7.16.1"},"memstats":{"gc_next":81807504,"memory_alloc":44452752,"memory_total":324999936,"rss":111435776},"runtime":{"goroutines":26}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":3300},"read":{"bytes":36}},"pipeline":{"clients":1,"events":{"active":4117}}}}}} 2022-01-06T10:17:55.396+0800 DEBUG [eventlog] eventlog/cache.go:136 messageFilesCache[Security] Evicting messageFiles {SourceName:Microsoft-Windows-Security-Auditing Err: Handles:[{File: Handle:16777255 Err:}]} for sourceName Microsoft-Windows-Security-Auditing. 2022-01-06T10:17:55.396+0800 DEBUG [eventlog] eventlog/cache.go:86 messageFilesCache[Security] size=0 2022-01-06T10:17:55.468+0800 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":687,"time":{"ms":94}},"total":{"ticks":3624,"time":{"ms":141},"value":3624},"user":{"ticks":2937,"time":{"ms":47}}},"handles":{"open":258},"info":{"ephemeral_id":"4bf426fc-501f-437c-8e1f-d2c06df67f0d","uptime":{"ms":156139},"version":"7.16.1"},"memstats":{"gc_next":81911216,"memory_alloc":40962328,"memory_total":325164808,"rss":100761600},"runtime":{"goroutines":26}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":3300},"read":{"bytes":36}},"pipeline":{"clients":1,"events":{"active":4117}}}}}} 2022-01-06T10:18:25.450+0800 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":734,"time":{"ms":47}},"total":{"ticks":3687,"time":{"ms":63},"value":3687},"user":{"ticks":2953,"time":{"ms":16}}},"handles":{"open":258},"info":{"ephemeral_id":"4bf426fc-501f-437c-8e1f-d2c06df67f0d","uptime":{"ms":186122},"version":"7.16.1"},"memstats":{"gc_next":81911216,"memory_alloc":41112824,"memory_total":325315304,"rss":98484224},"runtime":{"goroutines":26}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":3300},"read":{"bytes":36}},"pipeline":{"clients":1,"events":{"active":4117}}}}}} 2022-01-06T10:18:55.463+0800 INFO [monitoring] log/log.go:184 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":781,"time":{"ms":47}},"total":{"ticks":3765,"time":{"ms":78},"value":3765},"user":{"ticks":2984,"time":{"ms":31}}},"handles":{"open":256},"info":{"ephemeral_id":"4bf426fc-501f-437c-8e1f-d2c06df67f0d","uptime":{"ms":216134},"version":"7.16.1"},"memstats":{"gc_next":81911216,"memory_alloc":41271256,"memory_total":325473736,"rss":98467840},"runtime":{"goroutines":26}},"libbeat":{"config":{"module":{"running":0}},"output":{"events":{"active":3300},"read":{"bytes":36}},"pipeline":{"clients":1,"events":{"active":4117}}}}}} ``` ---
### Author: ![Frank\_Kuo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_kuo/32/90467_2.png) [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo) #### Post date: [January 10, 2022, 12:57am UTC](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607/2 "2022-01-10T00:57:32Z")
![擷取](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fdffc89f81a80432ef542d083de669b9a84e5f48.png) Happened again! 1/6、1/7 fewer data into ES...It should like other day (mark in yellow)... Why? ---
### Author: ![Frank\_Kuo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_kuo/32/90467_2.png) [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo) #### Post date: [January 14, 2022, 3:40am UTC](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607/3 "2022-01-14T03:40:11Z")
This issue has been closed. ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [February 11, 2022, 5:40am UTC](https://discuss.elastic.co/t/incomplete-data-transfer-on-winlogbeat-7-16-1/293607/4 "2022-02-11T05:40:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.