# Winlogbeat loses some events from Microsoft-IIS-Logging/Logs

**URL:** <https://discuss.elastic.co/t/winlogbeat-loses-some-events-from-microsoft-iis-logging-logs/227513>\
**Category:** Beats\
**Tags:** windows, winlogbeat\
**Created:** [April 10, 2020, 1:53pm UTC](https://discuss.elastic.co/t/winlogbeat-loses-some-events-from-microsoft-iis-logging-logs/227513 "2020-04-10T13:53:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ret](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Ret](https://discuss.elastic.co/u/Ret)\
**Post date:** [April 10, 2020, 1:53pm UTC](https://discuss.elastic.co/t/winlogbeat-loses-some-events-from-microsoft-iis-logging-logs/227513/1 "2020-04-10T13:53:01Z")

</div>

Hi all,

**Issue:** winlogbeat loses windows events from Microsoft-IIS-Logging/Logs

**Scenario:** I collect the logs of the IIS in Windows Events. Then I send them to the elasticsearch with winlogbetat. But for some reason, winlogbeat loses most of the events.  
For example, IIS generates ~5000 events per 1 min, and ~1500 send to elasticsearch from them.  
I checked the winlogbeat log file and searched for "error" and received no results.

Maybe winlogbeat can't handle a large stream of events?

**winlogbeat conf:**

```auto
    winlogbeat.event_logs:
      - name: Application
        level: Critical, Error, Warning
        provider:
            - Team Build Service
            - Team Foundation Error Reporting
            - Team Web Access
            - TeamFoundationSshService
            - TFS Build
            - TFS Deployment Rig
            - TFS Lab Management
            - TFS Proxy Server
            - TFS Scheduler
            - TFS Services
            - TFS Sync Service
            - TFS Test Management
            - TFS Test Rig
            - TFS Version Control
            - TFS Warehouse
            - TFS WorkItem Tracking
      - name: Microsoft-IIS-Logging/Logs
        ignore_older: 72h

    #==================== Elasticsearch template setting ==========================

    setup.template.settings:
      index.number_of_shards: 5

    setup.dashboards.enabled: false

    #----------------------------- Logstash output --------------------------------
    output.logstash:
      # The Logstash hosts
        hosts: ["logstash_host:5044"]

    processors:
      - add_host_metadata: ~
      - add_cloud_metadata: ~

```

---

<div class="post-metadata">

**Author:** ![Ret](https://avatars.discourse-cdn.com/v4/letter/r/87869e/32.png) [@Ret](https://discuss.elastic.co/u/Ret)\
**Post date:** [April 17, 2020, 7:10am UTC](https://discuss.elastic.co/t/winlogbeat-loses-some-events-from-microsoft-iis-logging-logs/227513/2 "2020-04-17T07:10:27Z")

</div>

Maybe there are some ideas why this could happen?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2020, 7:10am UTC](https://discuss.elastic.co/t/winlogbeat-loses-some-events-from-microsoft-iis-logging-logs/227513/3 "2020-05-15T07:10:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.