# Winlogbeat does not write specific eventlog status in registry file

**URL:** <https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 19, 2018, 4:57pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750 "2018-04-19T16:57:41Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ld57](https://avatars.discourse-cdn.com/v4/letter/l/85f322/32.png) [@ld57](https://discuss.elastic.co/u/ld57)\
**Post date:** [April 19, 2018, 4:57pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/1 "2018-04-19T16:57:41Z")

</div>

Hello all,

We meet a strange issue where a specific monitored eventlog does not appear in the registry file, and when we restart winlogbeat, it resends again from the beginning.  
This does not affect eventlogs system, security or Application.

Conditions :  
winlogbeat 6.2.3  
windows server 2016  
logstash 6.2.3

we use windows event subscription to send some events from multiple machines to one.  
These go to "Forwarded Events" eventlog

```auto
Get-WinEvent -ListLog * | Format-List -Property LogName
...
LogName : Application
LogName : HardwareEvents
LogName : Internet Explorer
LogName : Key Management Service
LogName : Operations Manager
LogName : Security
LogName : System
LogName : Windows PowerShell
LogName : ForwardedEvents
...

```

we use winlogbeat to monitor ForwardedEvents.  
Winlogbeat monitors and send correctly events from **ForwardedEvents** to Es ou logstash (situation here).  
the issue is just it always restarts from beginning.

here the winlogbeat.yml

```auto
###################### Winlogbeat Configuration Example ##########################

# This file is an example configuration file highlighting only the most common
# options. The winlogbeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/winlogbeat/index.html

#======================= Winlogbeat specific options ==========================

# event_logs specifies a list of event logs to monitor as well as any
# accompanying options. The YAML data type of event_logs is a list of
# dictionaries.
#
# The supported keys are name (required), tags, fields, fields_under_root,
# forwarded, ignore_older, level, event_id, provider, and include_xml. Please
# visit the documentation for the complete details of each option.
# https://go.es.io/WinlogbeatConfig
winlogbeat.event_logs:
  - name: ForwardedEvents
  # - name: Application
    ignore_older: 72h
  # - name: Security
  # - name: System

#adding options
fields_under_root: true
fields:
# env: staging
  type: misp_winlogbeat

#Output
output.logstash:
  # The Logstash hosts
  hosts: ["10.10.10.10:1010"]

```

and here the registry file content

```auto
update_time: 2018-04-19T16:46:54.1673795Z
event_logs:
- name: Microsoft-Windows-AppLocker/EXE and DLL
  record_number: 13234061
  timestamp: 2018-04-19T16:45:57.1890798Z
- name: Microsoft-Windows-AppLocker/MSI and Script
  record_number: 9580
  timestamp: 2018-04-19T16:30:03.9205687Z
- name: Microsoft-Windows-Sysmon/Operational
  record_number: 4867521
  timestamp: 2018-04-19T16:44:14.9419412Z
- name: Security
  record_number: 4400953
  timestamp: 2018-04-19T16:46:46.6696393Z
- name: System
  record_number: 60742
  timestamp: 2018-04-19T12:57:06Z

```

I do not understand why I see those eventlogs, but not mine specified in the config file **(ForwardedEvents)**

Did I do something wrong ?

Rgrds,

Ld

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [April 20, 2018, 8:30am UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/2 "2018-04-20T08:30:41Z")

</div>

Is there any error or warning printed to winlogbeat.log ?

Please share the debug log resulting of running winlogbeat with the `-d *` option.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [May 3, 2018, 4:53pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/3 "2018-05-03T16:53:01Z")

</div>

Hi @ld57,

My mistake, I was convinced that support for Forwarded Events was available in 6.2, but it isn't there. You can wait for 6.3 which is around the corner or use a [snapshot build.](https://s3-us-west-2.amazonaws.com/beats-package-snapshots/index.html?prefix=winlogbeat/)

---

<div class="post-metadata">

**Author:** ![ld57](https://avatars.discourse-cdn.com/v4/letter/l/85f322/32.png) [@ld57](https://discuss.elastic.co/u/ld57)\
**Post date:** [May 23, 2018, 2:28pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/4 "2018-05-23T14:28:55Z")

</div>

Hi @adrisr ,

sorry for the delay but I could not work on this and as it was running fine (till a restart), it was not a priority.

I will test the 6.3.x version and will give a feedback.

KR

Fred

---

<div class="post-metadata">

**Author:** ![Orsius](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orsius/32/13646_2.png) [@Orsius](https://discuss.elastic.co/u/Orsius)\
**Post date:** [May 23, 2018, 3:39pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/5 "2018-05-23T15:39:05Z")

</div>

Same issue here; is anyone already perform a check with the latest 6.3 version?  
kr,  
O.

---

<div class="post-metadata">

**Author:** ![conniia](https://avatars.discourse-cdn.com/v4/letter/c/b38774/32.png) [@conniia](https://discuss.elastic.co/u/conniia)\
**Post date:** [June 7, 2018, 6:55am UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/6 "2018-06-07T06:55:28Z")

</div>

Logstash server ip 5044 port did not receive the log from winlogbeat, how to solve it?Thanks

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [June 7, 2018, 7:59am UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/7 "2018-06-07T07:59:20Z")

</div>

Please open a separate question and provide more context, including your configuration and winlogbeat output if possible

---

<div class="post-metadata">

**Author:** ![ld57](https://avatars.discourse-cdn.com/v4/letter/l/85f322/32.png) [@ld57](https://discuss.elastic.co/u/ld57)\
**Post date:** [June 18, 2018, 12:16pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/8 "2018-06-18T12:16:38Z")

</div>

Hi,

unlucky, could not test it in 6.3 version yet.

anyone ?

Fred

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2018, 12:16pm UTC](https://discuss.elastic.co/t/winlogbeat-does-not-write-specific-eventlog-status-in-registry-file/128750/9 "2018-07-16T12:16:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.