# Winlogbeat event id missing

**URL:** <https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 16, 2021, 5:19pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200 "2021-12-16T17:19:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aditi\_salunke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditi_salunke/32/85600_2.png) [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\
**Post date:** [December 16, 2021, 5:19pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200/1 "2021-12-16T17:19:19Z")

</div>

Hello,

Will winlogbeat forward the log to Elasticsearch if it is installed on AD and when someone lockout from the system and if the account lockout log is dropping on AD?

eg.: if 10 users are getting locked out on their systems , we can see lockout logs on kibana only for 4 users .

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [December 20, 2021, 5:06am UTC](https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200/2 "2021-12-20T05:06:49Z")

</div>

Do you have multiple domain controllers?

---

<div class="post-metadata">

**Author:** ![aditi\_salunke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditi_salunke/32/85600_2.png) [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\
**Post date:** [December 20, 2021, 5:31am UTC](https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200/3 "2021-12-20T05:31:43Z")

</div>

Yes but even after checking logs from winlogbeat which is on them, i cound not find the relevant log

---

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [December 20, 2021, 9:37am UTC](https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200/4 "2021-12-20T09:37:19Z")

</div>

Can I confirm that you are seeing the event ID 4740 in windows event log but it's not being sent to Elasticsearch?

Maybe it would help if you show us your winlogbeat.yml

---

<div class="post-metadata">

**Author:** ![aditi\_salunke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditi_salunke/32/85600_2.png) [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\
**Post date:** [December 20, 2021, 2:58pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200/5 "2021-12-20T14:58:36Z")

</div>

Yes not able to see in on Elasticsearch but appearing on dc

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2022, 4:59pm UTC](https://discuss.elastic.co/t/winlogbeat-event-id-missing/292200/6 "2022-01-17T16:59:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.