# Winlogbeat 5.0 output.file data do not update after launching (false alarm)

**URL:** <https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 2, 2016, 1:29am UTC](https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645 "2016-11-02T01:29:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jojo.pornebo](https://avatars.discourse-cdn.com/v4/letter/j/c57346/32.png) [@jojo.pornebo](https://discuss.elastic.co/u/jojo.pornebo)\
**Post date:** [November 2, 2016, 1:29am UTC](https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645/1 "2016-11-02T01:29:44Z")

</div>

Winlogbeat 5.0  
config output.file  
Run winlogbeat updates the winlogbeat data from the Windows event log.  
Any new event log does not get captured onto the winlogbeat data.

Using the same wnlogbeat.yml config file (slightly reconfigured for syntax) works on v.1.3.1 - the winlogbeat updates every 30 secs with new event logs from Windows.

Is this bug on 5.0 ?

Note: I'm not publishing to logstash at all yet, just trying to run winlogbeat sending event logs to a local output file.

Jojo

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 2, 2016, 4:06pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645/2 "2016-11-02T16:06:39Z")

</div>

Please post the configuration that you are using and the log output from Winlogbeat.

---

<div class="post-metadata">

**Author:** ![jojo.pornebo](https://avatars.discourse-cdn.com/v4/letter/j/c57346/32.png) [@jojo.pornebo](https://discuss.elastic.co/u/jojo.pornebo)\
**Post date:** [November 3, 2016, 3:47am UTC](https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645/3 "2016-11-03T03:47:55Z")

</div>

I'm sorry to say I am incorrect on my observation. Winlogbeat 5.0 is definitely updating. I could not see the file update because the file modified stamp is not changing plus the tail program I use is not dynamically updating. If I re-open the data outfile it shows the new event log. Sorry for the false alarm. JP

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2016, 3:47am UTC](https://discuss.elastic.co/t/winlogbeat-5-0-output-file-data-do-not-update-after-launching-false-alarm/64645/4 "2016-11-24T03:47:55Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.