# Winlogbeat default age to ingest

**URL:** <https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 7, 2018, 11:56pm UTC](https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374 "2018-10-07T23:56:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [October 7, 2018, 11:56pm UTC](https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374/1 "2018-10-07T23:56:24Z")

</div>

Hi all,  
What is the default time frame winlogbeat will ingest if ignore\_older is not specified?

I've deleted some indices for this month and would like to try and retrieve them back but I'm only getting today's

Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 8, 2018, 12:43am UTC](https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374/2 "2018-10-08T00:43:35Z")

</div>

The state is stored locally in a file at c:/ProgramData/winlogbeat/.winlogbeat.yml. So you need to stop winlogbeat, delete the file, then restart in order to make it resend all data from the beginning of time.

[https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#\_literal\_registry\_file\_literal](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#_literal_registry_file_literal)

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [October 8, 2018, 1:45am UTC](https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374/3 "2018-10-08T01:45:21Z")

</div>

Thank for your reply. How embarrassing I've missed that.  
I've stopped the winlogbeat service and removed the .winlogbeat.yml from the two servers and restarted and still waiting to see data older than today

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 8, 2018, 2:12am UTC](https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374/4 "2018-10-08T02:12:14Z")

</div>

Did you remove the ignore\_older options from the config file?

You should also check how much data is available in the log. It’s possible that there’s not more data than a day’s worth. It’s possible to adjust the log size in Windows to get longer retention periods.

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [October 8, 2018, 4:30am UTC](https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374/5 "2018-10-08T04:30:29Z")

</div>

Thanks Andrew,  
It looks like one of the other techies changed the log size to 128 MB, on our site it's 2 GB  
Appreciate the help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2018, 4:30am UTC](https://discuss.elastic.co/t/winlogbeat-default-age-to-ingest/151374/6 "2018-11-05T04:30:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.