# Winlogbeat can't send event id 4663, 4660

**URL:** <https://discuss.elastic.co/t/winlogbeat-cant-send-event-id-4663-4660/161030>\
**Category:** Beats\
**Created:** [December 16, 2018, 1:32pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-send-event-id-4663-4660/161030 "2018-12-16T13:32:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dodaeche](https://avatars.discourse-cdn.com/v4/letter/d/e56c9b/32.png) [@dodaeche](https://discuss.elastic.co/u/dodaeche)\
**Post date:** [December 16, 2018, 1:32pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-send-event-id-4663-4660/161030/1 "2018-12-16T13:32:09Z")

</div>

I'm using winlogbeat-6.5.3-windows-x86\_64 version on my desktop PC.  
I have setup my pc logging Object Access and winlogbeat works well.  
When I remove my test.txt file on my PC, Event ID 4660, 4663, and 4658 was generated on PC, and I can see them on Event Log Viewer.  
The Event ID 4658 is sent to EleasticSearch successfully and I can search it on Kibana.  
But Event ID 4660, 4663 is not found on Kibana.

I have checked winlogbeat log file but there is nothing related to errors.

I'm still don't know what's wrong with.

---- winlogbeat.yml ----

winlogbeat.event\_logs:

- name: Security  
ignore\_older: 72h

- name: Application  
ignore\_older: 72h

- name: System  
ignore\_older: 72h

- name: "Microsoft-Windows-Sysmon/Operational"  
ignore\_older: 72h

- name: "Microsoft-Windows-WindowsUpdateClient/Operational"

---- logstash.conf ----

output {  
if [type] == "wineventlog" {  
elasticsearch {  
hosts =\> ["[http://192.168.0.11:9200](http://192.168.0.11:9200)"]  
index =\> "test\_index"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 13, 2019, 3:32pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-send-event-id-4663-4660/161030/2 "2019-01-13T15:32:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.