I assume I'm missing something relatively basic here, but my search has yielded little. I'm using OSS agent version 7.0.1 on WIndows 7.
Following a successful install of winlogbeat which respects the "ignore_older" value of 72h set for dev purposes, I've increased the value in winlogbeat.yml to a more bulky 336h. My intention is to load the a useful amount of test data from existing hosts, but upon updating the yml file on the target hosts and restarting the service no additional events outside the original 72h period are shipped for indexing.
I suspected that the service might need to be rebuilt following the updates to the config. After updating the winlogbeats.yml file, stopping the winlogbeat service, performing un-installation, a host reboot and installation of the service using the included powershell scripts the host still fails to ship events within the new ignore_older timeframe.
Is this behavior typical, or am I missing something?
Appreciate any feedback.