Set Winlogbeat to wait before shipping events to Logstash

I want to set a time interval, about 5-10 minutes, before sending events with Winlogbeat to Logstash.

I read about the internal queue, but I don't fully understand if it does what I need.

Is it possible to ship a bulk of events on every specified time?

Thank you.

This isn't possible. The beats delivery model is to ship the events as soon as possible.

You might be able to accomplish something similar with a cron task (or scheduled task), but why?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.