# Log Sync time

**URL:** <https://discuss.elastic.co/t/log-sync-time/102500>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 3, 2017, 1:31am UTC](https://discuss.elastic.co/t/log-sync-time/102500 "2017-10-03T01:31:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shethsaam](https://avatars.discourse-cdn.com/v4/letter/s/f1d935/32.png) [@shethsaam](https://discuss.elastic.co/u/shethsaam)\
**Post date:** [October 3, 2017, 1:31am UTC](https://discuss.elastic.co/t/log-sync-time/102500/1 "2017-10-03T01:31:29Z")

</div>

Hi, I am having a setup wherein I am sending Win Event logs from my local machine (windows 10) to Elastic cloud (service). My Config: Winglogbeat -\>Elastic search -\> Kibana. Working on the setup, I need to find the default log sync time and also a method to change the log sync time. Help appreciated (New to Elastic community).

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 3, 2017, 1:44am UTC](https://discuss.elastic.co/t/log-sync-time/102500/2 "2017-10-03T01:44:25Z")

</div>

> [@shethsaam](#):
>
> I need to find the default log sync time

What does log sync time mean to you? And why do you need to change it? Winlogbeat basically reads the logs in real time and sends them to ES as fast as possible.

---

<div class="post-metadata">

**Author:** ![shethsaam](https://avatars.discourse-cdn.com/v4/letter/s/f1d935/32.png) [@shethsaam](https://discuss.elastic.co/u/shethsaam)\
**Post date:** [October 3, 2017, 3:22am UTC](https://discuss.elastic.co/t/log-sync-time/102500/3 "2017-10-03T03:22:02Z")

</div>

Hi Andrew,  
I want to use smaller sync interval to make clocks respond more quickly to newly generated logs and therefore to speed up the overall system. I want to analyze the effect of changing the sync interval on the time taken to represent the logs in Kibana.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 3, 2017, 1:27pm UTC](https://discuss.elastic.co/t/log-sync-time/102500/4 "2017-10-03T13:27:14Z")

</div>

You can modify the parameters for the elasticsearch output to cause it to flush its queue sooner when it is not full. By default it waits up to one second before flushing. If it fills up (50) before the one second it will flush immediately.

See [bulk\_max\_size](https://www.elastic.co/guide/en/beats/winlogbeat/current/elasticsearch-output.html#_bulk_max_size) and `flush_interval`.

```auto
output.elasticsearch:
  hosts: ['localhost:9200']
  flush_interval: 1s
  bulk_max_size: 50

```

And then once the event is received by Elasticsearch it won't be searchable for up to 1s (the default refresh interval). [https://www.elastic.co/guide/en/elasticsearch/guide/2.x/near-real-time.html#refresh-api](https://www.elastic.co/guide/en/elasticsearch/guide/2.x/near-real-time.html#refresh-api)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2017, 1:27pm UTC](https://discuss.elastic.co/t/log-sync-time/102500/5 "2017-10-31T13:27:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.