# WinlogBeat to Logstash integration

**URL:** <https://discuss.elastic.co/t/winlogbeat-to-logstash-integration/191669>\
**Category:** Logstash\
**Created:** [July 22, 2019, 3:24pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-integration/191669 "2019-07-22T15:24:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![akhilsharma.in](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\
**Post date:** [July 22, 2019, 3:24pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-integration/191669/1 "2019-07-22T15:24:21Z")

</div>

Hi Team -  
Winlogbeat is sending events to Logstash at 5044. I have below questions:

1. In winlogbeat, if I set ignore\_older: 10s  
Does this mean that Winlogbeat will check if there are any new events before 10 seconds, or in last 10 seconds? And in this case, can I miss any events in any of the situation? I don't want to miss any events. I want all the events to go to Logstash. If I set it to 1 hour, will it check for new events in last one hour or it will check for new events before one hour and those are not parsed yet? Please make me understand the use of ignore\_older.

2. If I don't mention "ignore\_older", what difference will it make to my setup? What is the default check?

3. What is the default beat time of Winlogbeat or Logstash? After how many seconds or miliseconds it checks for the new events or logs?

Thanks  
Akhil Sharma

---

<div class="post-metadata">

**Author:** ![akhilsharma.in](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\
**Post date:** [July 22, 2019, 3:30pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-integration/191669/2 "2019-07-22T15:30:10Z")

</div>

And  
4. If I turn off Logstash and WinlogBeat for 1 hour. Can I send these events to Logstash which were generated during the time of outage?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 22, 2019, 4:32pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-integration/191669/3 "2019-07-22T16:32:33Z")

</div>

Winlogbeat will read logs from the beginning the first time it runs. That can lead to it ingesting very old logs that are of no interest. ignore\_older can be used to tell it to ignore events older than some threshold. 10s is an extremely low threshold that may cause data loss if winlogbeat ever restarts. I would set it to at least a couple of days (e.g. 72h).

If you do not include ignore\_older then the first time it runs, winlogbeat will ingest data from the very beginning of the event log.

When it shuts down, winlogbeat persists how far in the event log it has read, and starts again from that point when it starts up again. So you should get events generated when winlogbeat was down once it comes back up.

---

<div class="post-metadata">

**Author:** ![akhilsharma.in](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\
**Post date:** [July 23, 2019, 12:02pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-integration/191669/4 "2019-07-23T12:02:09Z")

</div>

Thanks for the answers. It helped 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2019, 12:17pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-integration/191669/5 "2019-08-20T12:17:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.