# Winlogbeat registry file issues

**URL:** <https://discuss.elastic.co/t/winlogbeat-registry-file-issues/247567>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [September 4, 2020, 3:22pm UTC](https://discuss.elastic.co/t/winlogbeat-registry-file-issues/247567 "2020-09-04T15:22:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jlwingo](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@jlwingo](https://discuss.elastic.co/u/jlwingo)\
**Post date:** [September 4, 2020, 3:22pm UTC](https://discuss.elastic.co/t/winlogbeat-registry-file-issues/247567/1 "2020-09-04T15:22:22Z")

</div>

I am new to winlogbeat and just trying to get it rolled out across all of our windows servers.

I just pushed out Winlogbeat to our devtest environment. I had no issues with sandbox environment or any issues when test in my local environment.

Winlogbeat version - 7.9.0

# ====== Winlogbeat specific options =========

winlogbeat.registry\_file: C:/ProgramData/winlogbeat/.winlogbeat.yml  
winlogbeat.shutdown\_timeout: 60s

winlogbeat.event\_logs:

- name: Application  
ignore\_older: 30m

- name: System  
ignore\_older: 30m

- name: Security  
ignore\_older: 30m

- name: Microsoft-IIS-Logging/Logs  
ignore\_older: 30m

# == Outputs ===

Registry File:  
**File Contents - problem server**  
update\_time: 2020-09-04T14:51:42.2454804Z  
event\_logs:

**File Contents - working server**  
update\_time: 2020-09-04T15:18:37.2668994Z  
event\_logs:

- name: Application  
record\_number: 2317  
timestamp: 2020-09-04T14:31:11.2885802Z  
bookmark: "\r\n \r\n"
- name: Security  
record\_number: 648070  
timestamp: 2020-09-04T15:18:32.962626Z  
bookmark: "\r\n \r\n"
- name: System  
record\_number: 49856  
timestamp: 2020-09-04T15:14:08.9264544Z  
bookmark: "\r\n \r\n"

SaltState is managed in Gitlab. No changes were made to it between the time it was merged from Sandbox to DevTest.

I have compared the winlogbeat.yml file in C:\Program Files\Winlogbeat on both servers and they match.

Any thoughts on what might be causing my issue? I can provide additional info if helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 2, 2020, 5:22pm UTC](https://discuss.elastic.co/t/winlogbeat-registry-file-issues/247567/2 "2020-10-02T17:22:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.