# Winlogbeat Restart Services

**URL:** <https://discuss.elastic.co/t/winlogbeat-restart-services/168188>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 13, 2019, 10:57am UTC](https://discuss.elastic.co/t/winlogbeat-restart-services/168188 "2019-02-13T10:57:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [February 13, 2019, 10:57am UTC](https://discuss.elastic.co/t/winlogbeat-restart-services/168188/1 "2019-02-13T10:57:27Z")

</div>

Quick question.

The ignore: 72h function in the Winlogbeat sends logs from 3 days ago.

If I were to start winlogbeat and send a days worth of logs + the 3 days before and then restart winlogbeat. Would it send the 3 previous days worth of logs from that point again? (this would cause duplications).

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 13, 2019, 7:07pm UTC](https://discuss.elastic.co/t/winlogbeat-restart-services/168188/2 "2019-02-13T19:07:21Z")

</div>

Winlogbeat stores a "bookmark" (using Windows API terminology) to a file at `C:\ProgramData\winlogbeat\.winlogbeat.yml` and it uses this to resume from the last event that it successfully sent. This way it avoids sending duplicates.

With `ignore_older: 72h` winlogbeat adds a filter to its query to the Windows API that says to only return events newer than 72h. So if you stopped Winlogbeat for 4 days (92h). It would resume from the last sent record that was 4 days old, but the 72h filter would make it skip over a full days worth of data.

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [February 15, 2019, 3:44pm UTC](https://discuss.elastic.co/t/winlogbeat-restart-services/168188/3 "2019-02-15T15:44:31Z")

</div>

Thank you Andrew! Perfect

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2019, 3:55pm UTC](https://discuss.elastic.co/t/winlogbeat-restart-services/168188/4 "2019-03-15T15:55:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.