# Winlogbeat 1 thread full cpu usage

**URL:** <https://discuss.elastic.co/t/winlogbeat-1-thread-full-cpu-usage/358128>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 24, 2024, 1:17pm UTC](https://discuss.elastic.co/t/winlogbeat-1-thread-full-cpu-usage/358128 "2024-04-24T13:17:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Speertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/speertje/32/132442_2.png) [@Speertje](https://discuss.elastic.co/u/Speertje)\
**Post date:** [April 24, 2024, 1:17pm UTC](https://discuss.elastic.co/t/winlogbeat-1-thread-full-cpu-usage/358128/1 "2024-04-24T13:17:54Z")

</div>

Recently upgraded from 7.15.1 to 7.17.x and then to 8.latest.  
From then on, 1 cpu thread will be 100% consumed by winlogbeat.  
OS is windows2016  
Looking at the metrics, it is processing between 7 and 100 events per 30 seconds, and delivering that succesfully to logstash.

I can limit the scope to 2 types of applications (proprietary), so I know it is not a generic issue.

winlogbeat.yml:

```auto
winlogbeat.registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml
winlogbeat.event_logs:
  - name: "Application"
  - name: "Security"
    event_id: -4663
  - name: "System"
  - name: "Microsoft-Windows-PrintService/Admin"

name: xxx.xxx.xxxx.xxxx

fields_under_root: false
#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts:
    - logstash.xxx.xxx.xxx:xxxx
  loadbalance: false
  ssl:
    enabled: true

```

Any debugging help would be appreciated