# What happens when I stop the Winlogbeat service? **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [March 24, 2016, 7:12pm UTC](https://discuss.elastic.co/t/what-happens-when-i-stop-the-winlogbeat-service/45389 "2016-03-24T19:12:15Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Kevin-Valle](https://avatars.discourse-cdn.com/v4/letter/k/50afbb/32.png) [@Kevin-Valle](https://discuss.elastic.co/u/Kevin-Valle)\ **Post date:** [March 24, 2016, 7:12pm UTC](https://discuss.elastic.co/t/what-happens-when-i-stop-the-winlogbeat-service/45389/1 "2016-03-24T19:12:15Z")
Hi, just a quick question regarding what happens when the Winlogbeat service is stopped: Is there a possibility of losing unsent events? Or does the service wait until all unsent messages are sent before shutting down? Would a negative bulk\_max\_size help ensure that no events can be lost? Context: I am running Winlogbeat in a VM for a period of time with no intent of reloading after the VM is shut down. My primary concern is possibly losing events in the process of shutting down the VM. I am sending events to a Logstash instance. Any help would be appreciated. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 24, 2016, 10:57pm UTC](https://discuss.elastic.co/t/what-happens-when-i-stop-the-winlogbeat-service/45389/2 "2016-03-24T22:57:27Z")
> [@Kevin-Valle](#): > > Is there a possibility of losing unsent events? Winlogbeat stores its read position on disk and this file is updated only after an acknowledgement is received from the output destination (i.e. Logstash, Elasticsearch). If there is a failure (power loss, machine crash) Winlogbeat will simply resume sending from last ACK'ed record. A few events may be duplicated but **none are ever lost** (at-least-once semantics). > [@Kevin-Valle](#): > > what happens when the Winlogbeat service is stopped On normal shutdown it will stop reading, flush the state the disk, and exit. It does not read to the end of the event log before exiting. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 12, 2016, 1:48pm UTC](https://discuss.elastic.co/t/what-happens-when-i-stop-the-winlogbeat-service/45389/3 "2016-04-12T13:48:13Z")