# \[Winlogbeat\] won't exit; winlogbeat JSON output size is different for same file

**URL:** <https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [January 28, 2022, 1:08pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706 "2022-01-28T13:08:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashimmahara](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@ashimmahara](https://discuss.elastic.co/u/ashimmahara)\
**Post date:** [January 28, 2022, 1:08pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706/1 "2022-01-28T13:08:12Z")

</div>

- Program: Winlogbeat
- Version: 7.16.3
- Operating System: Windows 11 Pro Version 21H2 Build 22000.438

I am trying to convert some archived evtx files to JSON using winlogbeat, however, winlogbeat isn't exiting after processing the evtx file and the size of the output json file is also different for each run. I am deleting the data sub-directory where evtx-registry.yml and other files used for tracking are located for each new run along with the output file. There is nothing suspicious on the command line logs for winlogbeat.

I am using PowerShell to execute the following command for each file in the directory:

`./winlogbeat-7.16.3-windows-x86_64\winlogbeat-7.16.3-windows-x86_64\winlogbeat.exe -e -c ./winlogbeat-evtx.yml -E EVTX_FILE="$filePath" -E OUTPUT_PATH="$output_path" -E FILENAME="$output_file_name"`

winlogbeat-evtx.yml

```auto
 - name: ${EVTX_FILE}
   forwarded: true
   no_more_events: stop

winlogbeat.shutdown_timeout: 5s
winlogbeat.registry_file: evtx-registry.yml

processors:
  - add_fields:
        target: ''
        fields:
            log_file: ${EVTX_FILE}
  - drop_fields:
        fields: ["event.kind", "event.code", "agent.ephemeral_id", "ecs.version"]
        
output.elasticsearch:
  enabled: false

output.logstash:
  enabled: false

output.kafka:
  enabled: false
  
output.file:
  enabled: true
  codec.json:
    pretty: true
    escape_html: false
  rotate_every_kb: 5000000
  path: ${OUTPUT_PATH}
  filename: ${FILENAME}

```

I assume that `shutdown_timeout` and `no_more_events` are not working as expected. Or is it because of the JSON file output? Maybe they are not tested or applied while using file outputs.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 28, 2022, 2:27pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706/2 "2022-01-28T14:27:15Z")

</div>

I saw another report of this. We'll look into it and report back.

---

<div class="post-metadata">

**Author:** ![taylor-swanson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taylor-swanson/32/100638_2.png) [@taylor-swanson](https://discuss.elastic.co/u/taylor-swanson)\
**Post date:** [January 28, 2022, 5:03pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706/3 "2022-01-28T17:03:17Z")

</div>

This is indeed a bug and we have fix by a community member submitted as a pull request. It is currently under review: [Fix loop while reading from standalone evtx by grishinpv · Pull Request #30006 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/30006)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2022, 7:04pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-exit-winlogbeat-json-output-size-is-different-for-same-file/295706/4 "2022-02-25T19:04:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.