# Winlogbeat queuing when Logstash offline

**URL:** <https://discuss.elastic.co/t/winlogbeat-queuing-when-logstash-offline/237968>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 21, 2020, 4:00pm UTC](https://discuss.elastic.co/t/winlogbeat-queuing-when-logstash-offline/237968 "2020-06-21T16:00:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sera](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@sera](https://discuss.elastic.co/u/sera)\
**Post date:** [June 21, 2020, 4:00pm UTC](https://discuss.elastic.co/t/winlogbeat-queuing-when-logstash-offline/237968/1 "2020-06-21T16:00:55Z")

</div>

Apologies if this has been asked before, but I have hunted around and can't find anything specific. I'm sending domain controller logs to Logstash with Winlogbeat. Windows Performance Monitor shows Winlogbeat process using 30MB memory during normal operations. If I take Logstash offline the memory use gradually climbs to 53MB, and then seems continue growing but only very slightly. I've left it for a day now. What should I expect to see if Logstash stays offline? Should resources remain flat or gradually increase?

I haven't changed anything from default other than winlogbeat.yml as follows:

```auto
winlogbeat.event_logs:
  - name: Application
    ignore_older: 1h

  - name: System
    ignore_older: 1h

  - name: Security
    ignore_older: 1h

output.logstash:
  hosts: ["192.168.100.100:5044"]

```

I don't especially care if I lose logs while Logstash is offline. I'm far more concerned about not causing any resource issues on our domain controllers.

Any advice appreciated  
Sera

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2020, 6:00pm UTC](https://discuss.elastic.co/t/winlogbeat-queuing-when-logstash-offline/237968/2 "2020-07-19T18:00:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.