# Winlogbeat can't send events to Elasticsearch

**URL:** <https://discuss.elastic.co/t/winlogbeat-cant-send-events-to-elasticsearch/218940>\
**Category:** Beats\
**Created:** [February 12, 2020, 10:10am UTC](https://discuss.elastic.co/t/winlogbeat-cant-send-events-to-elasticsearch/218940 "2020-02-12T10:10:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [February 12, 2020, 10:10am UTC](https://discuss.elastic.co/t/winlogbeat-cant-send-events-to-elasticsearch/218940/1 "2020-02-12T10:10:30Z")

</div>

Hello. We have near 2300 EPS comming on each WEC Windows collector and near 350 EPS that winlogbeat ship to Logstash or Elasticsearch (i test both).  
I try [a lot of things](https://www.elastic.co/blog/how-to-tune-elastic-beats-performance-a-practical-example-with-batch-size-worker-count-and-more) on winlogbeat side, but nothing happen. Then i i change output from Elastic to local file.  
And EPS increase from 350 to 4000 eps (and than to 2300). I also sure that problem is not in network connection.

 ![image-2020-02-12-12-11-56-527](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d160433cf40bfe98c1622fa975ee10019fa4067d.png)  
So, now i am sure that problem is in Elasticsearch.  
But when i check its log - i do not find nothing about dropping events. (journalctl -fu logstash or elasticsearch).

So, my question - how can i determine, that elasticsearch do not recieve events and my events drops?

---

<div class="post-metadata">

**Author:** ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\
**Post date:** [February 17, 2020, 8:59am UTC](https://discuss.elastic.co/t/winlogbeat-cant-send-events-to-elasticsearch/218940/2 "2020-02-17T08:59:22Z")

</div>

Do anybody have any comments? Simple question- how to determine and monitor, that Elastic can't recive all events that winlogbeat sends?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2020, 10:59am UTC](https://discuss.elastic.co/t/winlogbeat-cant-send-events-to-elasticsearch/218940/3 "2020-03-16T10:59:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.