# Winlogbeat Working

**URL:** <https://discuss.elastic.co/t/winlogbeat-working/163379>\
**Category:** Beats\
**Created:** [January 8, 2019, 2:06pm UTC](https://discuss.elastic.co/t/winlogbeat-working/163379 "2019-01-08T14:06:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yashwant\_Shettigar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yashwant_shettigar/32/47652_2.png) [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\
**Post date:** [January 8, 2019, 2:06pm UTC](https://discuss.elastic.co/t/winlogbeat-working/163379/1 "2019-01-08T14:06:28Z")

</div>

Hi All,

How does winlogbeat works exactly, in short?  
Like what parameters or depending on what conditions or in any specific intervals, data is shipped from client to ELK server?

As in filebeat, there is scan\_frequency which is one of the conditions to ship to data.

Thank You

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [January 9, 2019, 6:33pm UTC](https://discuss.elastic.co/t/winlogbeat-working/163379/2 "2019-01-09T18:33:58Z")

</div>

Filebeat is mostly used to watch files on disk, this is why you have the `scan_frequency` which is used to determinate when we will look for new files on disk.

In the case of Winlogbeat, it uses Window Event log API and it subscribe to specific channel and will receive events from them. You can use the Event log viewer to have a view of the possible channel that you can register.

Concerning the frequency of sending events to Elasticsearch it's dependent of two options, either we hit a timeout and we flush events to ES or we reach the batch size defined in the elasticsearch output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2019, 8:34pm UTC](https://discuss.elastic.co/t/winlogbeat-working/163379/3 "2019-02-06T20:34:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.