Replace winlogbeat configuration file

[justas]

Hi All,

What is the proper way to replace/update winlogbeat.yml file and force that file into the service? I expected modifying the .yml in programfiles/winlogbeat and service restart would pick it up, but it does not. Also I dont want to resend all the logs from last 24h (my setting in yml) if I uninstall and reinstall the service. Let me know, thanks

/Justas

[justas]

Closed.

[andrewkroh]

Modifying the config file at the path where Winlogbeat was installed from and then restarting will cause Winlogbeat it to use the new config.

To have Winlogbeat resend all data you must delete the registry file at C:\ProgramData\winlogbeat\.winlogbeat.yml which clears all stored state.

[warkolm (Mark Walkom)]

@justas

Closed

Why, did you fix it? If you fixed it please share the solution, it might help someone in the future.