# Winlogbeat not writing all events to Elasticsearch

**URL:** <https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559>\
**Category:** Elasticsearch\
**Created:** [August 3, 2020, 12:17pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559 "2020-08-03T12:17:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mozam](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@mozam](https://discuss.elastic.co/u/mozam)\
**Post date:** [August 3, 2020, 12:17pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559/1 "2020-08-03T12:17:09Z")

</div>

Hello,

I'm using the Elastic Stack version 7.8.0 ( Winlogbeat -\> Elasticsearch pipeline) in Windows 10 Operating System .

Issue : Winlogbeat not capturing all the events generated in Windows Machine. For eg: (Audit trial logs cleared, Failed Login attempts etc. ) events are not getting indexed to Elasticsearch.

But I can see few other event data indexed to Elasticsearch.

Please help me, whether I'm missing any additional configuration required to capture those events.

Thanks in Advance.

---

<div class="post-metadata">

**Author:** ![fgjensen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fgjensen/32/62320_2.png) [@fgjensen](https://discuss.elastic.co/u/fgjensen)\
**Post date:** [August 3, 2020, 12:40pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559/2 "2020-08-03T12:40:01Z")

</div>

Hi @mozam Did you remember to deploy the Sysmon module, see [Sysmon](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-module-sysmon.html) before starting Winlogbeat? If you compare to Auditbeat on Linux, Winlogbeat may not expose all required functionality yet, I belive.

---

<div class="post-metadata">

**Author:** ![mozam](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@mozam](https://discuss.elastic.co/u/mozam)\
**Post date:** [August 3, 2020, 12:42pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559/3 "2020-08-03T12:42:24Z")

</div>

Hi @fgjensen Thanks for the quick reply.

No I haven't, let me check.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2020, 12:42pm UTC](https://discuss.elastic.co/t/winlogbeat-not-writing-all-events-to-elasticsearch/243559/4 "2020-08-31T12:42:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.