Winlogbeat and Windows Event Log Service dependency

Elastic Stack Beats
1

Hi,
I have installed winlogbeat 7.4 in a windows server 2016.
I noticed that if I stop the Windows Event Log service winlogbeat is stopped automatically.
I read in the documentation about the event_logs.no_more_events setting, but is by default in wait, so the winlogbeat should wait until more events are generated. Instead of doing that, winlogbeat is stopped.
In fact, when I stop the logging service an Event 1100 is generated in the event Viewer but at this point winlogbeat is already down does not send the event to ES

Is this the normal behavior?
Thank you

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.