# Winlogbeat Services v. Command Line Implementation

**URL:** <https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 22, 2021, 9:50am UTC](https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630 "2021-06-22T09:50:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chris\_ts24](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_ts24/32/79048_2.png) [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\
**Post date:** [June 22, 2021, 9:50am UTC](https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630/1 "2021-06-22T09:50:33Z")

</div>

Hi all,

I'm sending windows logs via winlogbeat (v.7.13.2) to a logstash instance (v.7.13.0), which processes the logs and sends them to an ES index "winlogs" (v.7.13.0). I've set up the pipeline (no logstash filter yet implemented) following the [quick start manual](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html) and since I'm sending logs to logstash I've manually inserted the template using the alternate method listed [here](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually).

I've noticed that the service doesn't send logs to Logstash -\> ES the same way as a command line call "./winlogbeat.exe -e". Via the command line call, thousands of docs land in the index, whereas the service results in only a few dozen.

Can someone explain to me the difference? I was expecting the same behavior (all logs up to an _ignore\_older_ variable) from both the Command Line and Service implementation. Can one setup the service to run the same as the command line?

## Here my configurations:

winlogbeat.yml

```auto
winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
  - name: System
    ignore_older: 72h
  - name: Security
    ignore_older: 72h
    
output.logstash:
  hosts: ["127.0.0.1:5044"]
  
setup.template.enabled: false
setup.template.overwrite: false
setup.ilm.enabled: false

```

logstash beats config

```auto
input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "winlogs"
  }
}

```

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [June 22, 2021, 1:00pm UTC](https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630/2 "2021-06-22T13:00:28Z")

</div>

I noticed that winlogbeat sometimes puts the .winlogbeat.yml (it's registry of sent events) in it's "${path.data}" and sometimes it's "${path}". I suspect the both runs send the last 72's hours of data. Look at the service properties, it specifies -path.data and I suspect it's not the same as the default that is used when you run from the command line.

Why? I blame all Windows problems on the platform 🙂

---

<div class="post-metadata">

**Author:** ![chris\_ts24](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris_ts24/32/79048_2.png) [@chris\_ts24](https://discuss.elastic.co/u/chris_ts24)\
**Post date:** [June 22, 2021, 1:44pm UTC](https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630/3 "2021-06-22T13:44:26Z")

</div>

You were 100% correct. Thanks for the tip! That is strange behavior, but definitely not the first time that I've seen something like that happen. I'll pay closer attention to the services parameters as I move forward, but the number of records is now the same as the number I get when I sort my logs. 👌

Thanks a log! 😁

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2021, 3:44pm UTC](https://discuss.elastic.co/t/winlogbeat-services-v-command-line-implementation/276630/4 "2021-07-20T15:44:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.