Hi, just a quick question regarding what happens when the Winlogbeat service is stopped: Is there a possibility of losing unsent events? Or does the service wait until all unsent messages are sent before shutting down? Would a negative bulk_max_size help ensure that no events can be lost?
Context: I am running Winlogbeat in a VM for a period of time with no intent of reloading after the VM is shut down. My primary concern is possibly losing events in the process of shutting down the VM. I am sending events to a Logstash instance.
Any help would be appreciated.