# Winlogbeat don't collect some event

**URL:** <https://discuss.elastic.co/t/winlogbeat-dont-collect-some-event/213584>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [January 2, 2020, 2:23pm UTC](https://discuss.elastic.co/t/winlogbeat-dont-collect-some-event/213584 "2020-01-02T14:23:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ghl1l0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghl1l0/32/48128_2.png) [@ghl1l0](https://discuss.elastic.co/u/ghl1l0)\
**Post date:** [January 2, 2020, 2:23pm UTC](https://discuss.elastic.co/t/winlogbeat-dont-collect-some-event/213584/1 "2020-01-02T14:23:12Z")

</div>

I had install winlogbeat in windows 10 until now i received all log include secrutiy application ... except "Security Group Management" log

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 3, 2020, 3:30am UTC](https://discuss.elastic.co/t/winlogbeat-dont-collect-some-event/213584/2 "2020-01-03T03:30:26Z")

</div>

Are you saying that it was working on Windows 10 then it stopped?

What specific event IDs are not being collected? Are they available in the Event Viewer? What version of Winlogbeat? What's your config? Are there any errors in the log file?

---

<div class="post-metadata">

**Author:** ![ghl1l0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghl1l0/32/48128_2.png) [@ghl1l0](https://discuss.elastic.co/u/ghl1l0)\
**Post date:** [January 3, 2020, 11:01am UTC](https://discuss.elastic.co/t/winlogbeat-dont-collect-some-event/213584/3 "2020-01-03T11:01:03Z")

</div>

Winlogbeat is already working on Windows10 i receive all logs in database exept 4728,4732,4735 this logs are available on event viewer ,  
that's my config :  
winlogbeat.event\_logs:

- name: Application  
ignore\_older: 72h

- name: System

- name: Security  
processors:

- name: Microsoft-Windows-Sysmon/Operational  
processors:

setup.template.settings:  
index.number\_of\_shards: 1

---

<div class="post-metadata">

**Author:** ![ghl1l0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ghl1l0/32/48128_2.png) [@ghl1l0](https://discuss.elastic.co/u/ghl1l0)\
**Post date:** [January 9, 2020, 3:55pm UTC](https://discuss.elastic.co/t/winlogbeat-dont-collect-some-event/213584/4 "2020-01-09T15:55:11Z")

</div>

I received some log like event.code: 4722 OR 4724 but i don't receive the log like 4728 OR 4732

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2020, 3:55pm UTC](https://discuss.elastic.co/t/winlogbeat-dont-collect-some-event/213584/5 "2020-02-06T15:55:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.