# Winlogbeat delayed data shipping **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 28, 2019, 7:40pm UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176 "2019-05-28T19:40:38Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Alessio\_Creo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alessio_creo/32/43381_2.png) [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Post date:** [May 28, 2019, 7:40pm UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176/1 "2019-05-28T19:40:38Z")
Hi there, I'm collecting security register data from Active Directory dedicated Windows Server 2012 host, that pass via Logstash and finally land in ES. After the week-end I've a found an huge delay of 15 hours between data sent by winlogbeat and the current time when I search for them in Kibana. Beat and Logstash logs don't show any error and the sysadmin of the Domain controller says that the AD machine is okay. I've tried to write data that pass in Logstash in a file and they are actually related to 15 hours ago events. What can I do more to do troubleshooting and align the time? Thank you very much. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 29, 2019, 7:51am UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176/2 "2019-05-29T07:51:59Z")
Which version are you using? How many events per second is Winlogbeat processing approximately? Do you see any WARN on ERROR in Winlogbeat log? Such a huge time difference would usually indicate a timezone confusion between Beats and Kibana. ---
**Author:** ![Alessio\_Creo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alessio_creo/32/43381_2.png) [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Post date:** [May 29, 2019, 8:43am UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176/3 "2019-05-29T08:43:39Z")
Thank you very much for the answer. I'm using 6.2.4 version of winlogbeat and 6.7.1 version for Logstash. Approximately winlogebat publishes 3000 events per second. The strange thing is that I'm reading 2 registry of event viewer but just one is disaligned. ``` 2019-05-26T06:02:18.981+0200 ERROR logstash/async.go:235 Failed to publish events caused by: write tcp 10.160.0.12:59890->10.160.5.130:5051: wsasend: An existing connection was forcibly closed by the remote host. ``` this is an ERROR log but is such "normal" beacause I see it since months. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 30, 2019, 7:17pm UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176/4 "2019-05-30T19:17:38Z")
As you said, I don't think that error is an issue, as long as you receive it just from time to time. Logstash expires connections after a while, and the Beat can only find out it's closed once it tries to write. Winlogbeat will create a new connection immediately without any event being lost. Is it possible that the Event Log that is showing this delay is generating more than this 3000 events per second? ---
**Author:** ![Alessio\_Creo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alessio_creo/32/43381_2.png) [@Alessio\_Creo](https://discuss.elastic.co/u/Alessio_Creo)\ **Post date:** [May 30, 2019, 7:54pm UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176/5 "2019-05-30T19:54:33Z")
Yes.I think that could be possible. The data volume for that registry is about 20 mln of records per day. I wish to know if there is any "tune tip" to try aligning the data, because now I've reached 17 hours of delay. I hope that this huge volume is transitory. Thank you for the interest. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 27, 2019, 7:54pm UTC](https://discuss.elastic.co/t/winlogbeat-delayed-data-shipping/183176/6 "2019-06-27T19:54:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.