Set Winlogbeat to wait before shipping events to Logstash

Elastic Stack Beats
,
1

Hello,
I want to set a time interval, about 5-10 minutes, before sending events with Winlogbeat to Logstash.

I read about the internal queue, but I don't fully understand if it does what I need.

Is it possible to ship a bulk of events on every specified time?

Thank you.

2

This isn't possible. The beats delivery model is to ship the events as soon as possible.

You might be able to accomplish something similar with a cron task (or scheduled task), but why?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.