I have installed winlogbeat 7.4 in a windows server 2016.
I noticed that if I stop the Windows Event Log service winlogbeat is stopped automatically.
I read in the documentation about the event_logs.no_more_events setting, but is by default in wait, so the winlogbeat should wait until more events are generated. Instead of doing that, winlogbeat is stopped.
In fact, when I stop the logging service an Event 1100 is generated in the event Viewer but at this point winlogbeat is already down does not send the event to ES
Is this the normal behavior?