# Winlogbeat only sending one first Log source out of three **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [July 4, 2017, 6:53pm UTC](https://discuss.elastic.co/t/winlogbeat-only-sending-one-first-log-source-out-of-three/91803 "2017-07-04T18:53:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![x0r](https://avatars.discourse-cdn.com/v4/letter/x/7ba0ec/32.png) [@x0r](https://discuss.elastic.co/u/x0r)\ **Post date:** [July 4, 2017, 6:53pm UTC](https://discuss.elastic.co/t/winlogbeat-only-sending-one-first-log-source-out-of-three/91803/1 "2017-07-04T18:53:14Z")
Hey there everyone, I'm just wondering if anyone has ran into this issue or encountered what I have been struggling with. At this point in time I am using winlogbeat on a Domain Controller running windows 2012 R2 and I am trying to have it ship the "security" logs, "system" logs and "dns server" logs to a machine that is running logstash. For some reason winlogbeat will only send events from the first of the three that shows up in the config file. For testing I have even tried using the default winlogbeat.full.yml yet the results are the same. If I adjust the order in which the log names are listed within the config than the logs being sent will also adjust in-relation to the change made. Its as though winlogbeat wants to only send a max of one log type... Any suggestions or config changes would be gladly excepted! Thanks for the assistance and everyone have a wonderful day, Also, the version of all components is 5.4.3... Cheers, ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 4, 2017, 8:31pm UTC](https://discuss.elastic.co/t/winlogbeat-only-sending-one-first-log-source-out-of-three/91803/2 "2017-07-04T20:31:52Z")
Can you please share the config file that you are using with Winlogbeat. Also can you add `logging.level: debug` and `logging.selectors: [config]` to your config file and restart Winlogbeat. Then post the log file content. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 1, 2017, 8:32pm UTC](https://discuss.elastic.co/t/winlogbeat-only-sending-one-first-log-source-out-of-three/91803/3 "2017-08-01T20:32:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.