# Replace winlogbeat configuration file

**URL:** <https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 5, 2017, 5:55am UTC](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789 "2017-10-05T05:55:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![justas](https://avatars.discourse-cdn.com/v4/letter/j/9fc29f/32.png) [@justas](https://discuss.elastic.co/u/justas)\
**Post date:** [October 5, 2017, 5:55am UTC](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789/1 "2017-10-05T05:55:15Z")

</div>

Hi All,

What is the proper way to replace/update winlogbeat.yml file and force that file into the service? I expected modifying the .yml in programfiles/winlogbeat and service restart would pick it up, but it does not. Also I dont want to resend all the logs from last 24h (my setting in yml) if I uninstall and reinstall the service. Let me know, thanks 🙂

/Justas

---

<div class="post-metadata">

**Author:** ![justas](https://avatars.discourse-cdn.com/v4/letter/j/9fc29f/32.png) [@justas](https://discuss.elastic.co/u/justas)\
**Post date:** [October 5, 2017, 6:12am UTC](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789/2 "2017-10-05T06:12:28Z")

</div>

Closed.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 5, 2017, 3:31pm UTC](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789/3 "2017-10-05T15:31:41Z")

</div>

Modifying the config file at the path where Winlogbeat was installed from and then restarting will cause Winlogbeat it to use the new config.

To have Winlogbeat resend all data you must delete the [registry file](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#_registry_file) at `C:\ProgramData\winlogbeat\.winlogbeat.yml` which clears all stored state.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 6, 2017, 1:30am UTC](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789/4 "2017-10-06T01:30:13Z")

</div>

> [@justas](#):
>
> Closed

Why, did you fix it? If you fixed it please share the solution, it might help someone in the future.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2017, 1:30am UTC](https://discuss.elastic.co/t/replace-winlogbeat-configuration-file/102789/5 "2017-11-03T01:30:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.