# Winlogbeat doesn’t work since change of version

**URL:** https://discuss.elastic.co/t/winlogbeat-doesn-t-work-since-change-of-version/335087
**Category:** Beats
**Tags:** winlogbeat
**Created:** [June 2, 2023, 1:42pm UTC](https://discuss.elastic.co/t/winlogbeat-doesn-t-work-since-change-of-version/335087 "2023-06-02T13:42:16Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![blop135](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@blop135](https://discuss.elastic.co/u/blop135)
#### Post date: [June 2, 2023, 1:42pm UTC](https://discuss.elastic.co/t/winlogbeat-doesn-t-work-since-change-of-version/335087/1 "2023-06-02T13:42:17Z")

</div>

Hi everyone,

I have a little problem here. I decided to update from the version 6.8.4 to the version 7.17.7. The installation of winlogbeat went well but then it says in the logs that the connexion to Kafka is established but nothing else, it doesn’t push the new events to Kafka. When I revert back to 6.8.4, it works again, I can see the events are getting pushed to Kafka. I use the exact same winlogbeat.yml configuration file in both version.

What am I missing here?

Thanks in advance 🙂

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 2, 2023, 2:00pm UTC](https://discuss.elastic.co/t/winlogbeat-doesn-t-work-since-change-of-version/335087/2 "2023-06-02T14:00:42Z")

</div>

> [@blop135](#):
>
> I use the exact same winlogbeat.yml configuration file in both version.

Please share your `winlogbeat.yml` file.

---

<div class="post-metadata">

### Author: ![blop135](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@blop135](https://discuss.elastic.co/u/blop135)
#### Post date: [June 2, 2023, 2:30pm UTC](https://discuss.elastic.co/t/winlogbeat-doesn-t-work-since-change-of-version/335087/3 "2023-06-02T14:30:38Z")

</div>

Sure, there you go:

```auto
winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
    level: critical, error, warning, information
    tags: ["system"]
    include_xml: true
  - name: Security
    ignore_older: 72h
    level: critical, error, warning, information
    tags: ["system"]
    include_xml: true
  - name: Setup
    ignore_older: 72h
    level: critical, error, warning, information
    tags: ["system"]
    include_xml: true
  - name: System
    ignore_older: 72h
    level: critical, error, warning, information
    tags: ["system"]
 
output.kafka:
  # Boolean flag to enable or disable the output module.
  enabled: true
 
  hosts: ["mykafkaserver:9092"]
  topic: logstash-windows-events
 
logging.metrics.enabled: false

```

---

<div class="post-metadata">

### Author: ![blop135](https://avatars.discourse-cdn.com/v4/letter/b/ce73a5/32.png) [@blop135](https://discuss.elastic.co/u/blop135)
#### Post date: [June 22, 2023, 7:37am UTC](https://discuss.elastic.co/t/winlogbeat-doesn-t-work-since-change-of-version/335087/4 "2023-06-22T07:37:14Z")

</div>

Anybody have an idea? It still not works.

Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2023, 9:38am UTC](https://discuss.elastic.co/t/winlogbeat-doesn-t-work-since-change-of-version/335087/5 "2023-07-20T09:38:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.