# Winlogbeat for windows 10

**URL:** <https://discuss.elastic.co/t/winlogbeat-for-windows-10/189179>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [July 6, 2019, 3:37am UTC](https://discuss.elastic.co/t/winlogbeat-for-windows-10/189179 "2019-07-06T03:37:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![syllamiran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syllamiran/32/47280_2.png) [@syllamiran](https://discuss.elastic.co/u/syllamiran)\
**Post date:** [July 6, 2019, 3:37am UTC](https://discuss.elastic.co/t/winlogbeat-for-windows-10/189179/1 "2019-07-06T03:37:03Z")

</div>

Hello. Why the results of logs with winlogbeat 7.2 is differents between Windows 10 1803 (not have an Windows event ID) and windows 1903 (have an windows event ID like 4624, 4800)? The configuration has the same in both systemes. Thanks

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 8, 2019, 11:35pm UTC](https://discuss.elastic.co/t/winlogbeat-for-windows-10/189179/2 "2019-07-08T23:35:54Z")

</div>

Can you share your configuration please?

winglogbeat uses system libraries to query the logs. I wonder if there is a difference/bug with windows itself.

---

<div class="post-metadata">

**Author:** ![ygel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ygel/32/55561_2.png) [@ygel](https://discuss.elastic.co/u/ygel)\
**Post date:** [July 9, 2019, 10:14pm UTC](https://discuss.elastic.co/t/winlogbeat-for-windows-10/189179/3 "2019-07-09T22:14:51Z")

</div>

Hello Miran, I tried to repro the issue with latest WInlogbeat and ES available on the downloads page. I see event id's. I setup two VM's with Windows 10 1803 April and May updates, they talk to a local ES node. I let it run for a bit while running query below every now and then. I'm afraid we'll need more information to diagnose this.

```
 curl -sSL -XGET -H "content-type: application/json" \
                 http://192.168.132.1:9200/_search?size=9999 -d @esq2 \
                | jq '.hits.total'

```

file `esq2`:

```
{
"query": {
    "bool": {
        "must_not": {
            "exists": {
                "field": "winlog.event_id"
            }}}}}

```

Response body:

```
{
  "value": 0,
  "relation": "eq"
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2019, 10:14pm UTC](https://discuss.elastic.co/t/winlogbeat-for-windows-10/189179/4 "2019-08-06T22:14:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.