Winlog beat data issue

How many beats (winlog) I can connect after Trail License expired ?
The problem is I dont see events from newly configured beats starting from moment when license has expired.

Is my issue related to license or I am doing something wrong ?


You should check the logs for Winlogbeat to help determine the cause. By default they are in C:\ProgramData\winlogbeat.

As long as you have minimally have the free Basic license Winlogbeat will ingest data directly to Elasticsearch. You can can use POST /_license/start_basic to setup a basic license on your cluster.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.