# Winlogbeat and Windows Event Log Service dependency

**URL:** <https://discuss.elastic.co/t/winlogbeat-and-windows-event-log-service-dependency/206978>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 7, 2019, 2:56pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-log-service-dependency/206978 "2019-11-07T14:56:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\
**Post date:** [November 7, 2019, 2:56pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-log-service-dependency/206978/1 "2019-11-07T14:56:48Z")

</div>

Hi,  
I have installed winlogbeat 7.4 in a windows server 2016.  
I noticed that if I stop the Windows Event Log service winlogbeat is stopped automatically.  
I read in the documentation about the event\_logs.no\_more\_events setting, but is by default in wait, so the winlogbeat should wait until more events are generated. Instead of doing that, winlogbeat is stopped.  
In fact, when I stop the logging service an Event 1100 is generated in the event Viewer but at this point winlogbeat is already down does not send the event to ES

Is this the normal behavior?  
Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2019, 2:56pm UTC](https://discuss.elastic.co/t/winlogbeat-and-windows-event-log-service-dependency/206978/2 "2019-12-05T14:56:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.