# Unable to ship logs using Winlogbeat due to poor Windows API Performance

**URL:** https://discuss.elastic.co/t/unable-to-ship-logs-using-winlogbeat-due-to-poor-windows-api-performance/350729
**Category:** Beats
**Tags:** winlogbeat
**Created:** [January 10, 2024, 10:26am UTC](https://discuss.elastic.co/t/unable-to-ship-logs-using-winlogbeat-due-to-poor-windows-api-performance/350729 "2024-01-10T10:26:22Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![TheGrea](https://avatars.discourse-cdn.com/v4/letter/t/50afbb/32.png) [@TheGrea](https://discuss.elastic.co/u/TheGrea)
#### Post date: [January 10, 2024, 10:26am UTC](https://discuss.elastic.co/t/unable-to-ship-logs-using-winlogbeat-due-to-poor-windows-api-performance/350729/1 "2024-01-10T10:26:22Z")

</div>

Hi Community,

when I ship Windows Event Logs from a Windows Event Collector Log, that contain Logs where the provider is not registered on the WEC to Elasticsearch using Winlogbeat (v 8.9.0) the performance is so poor, that the majority of events are lost.

I can work around this issue by eighter registering every single event log provider on the WEC or by setting event\_logs.api to wineventlog-experimental .

Since I was able to reproduce the issue using the Powershell cmdlet Get-WinEvent I opened a Microsoft Q&A question, but haven't received an answer, that solves my issue so far. So i thought maybe someone from this community has faced the same issue and could give me an advice how to deal with this situation.

Thanks in advance

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 7, 2024, 12:26pm UTC](https://discuss.elastic.co/t/unable-to-ship-logs-using-winlogbeat-due-to-poor-windows-api-performance/350729/2 "2024-02-07T12:26:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
