Replace winlogbeat configuration file

Elastic Stack Beats
1

Hi All,

What is the proper way to replace/update winlogbeat.yml file and force that file into the service? I expected modifying the .yml in programfiles/winlogbeat and service restart would pick it up, but it does not. Also I dont want to resend all the logs from last 24h (my setting in yml) if I uninstall and reinstall the service. Let me know, thanks :slight_smile:

/Justas

2

Closed.

3

Modifying the config file at the path where Winlogbeat was installed from and then restarting will cause Winlogbeat it to use the new config.

To have Winlogbeat resend all data you must delete the registry file at C:\ProgramData\winlogbeat\.winlogbeat.yml which clears all stored state.

1 Like
4

Why, did you fix it? If you fixed it please share the solution, it might help someone in the future.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.