# \[WinLogBeats\] Missing events from ForwardedEvents channel

**URL:** <https://discuss.elastic.co/t/winlogbeats-missing-events-from-forwardedevents-channel/224296>\
**Category:** Beats\
**Created:** [March 19, 2020, 5:21pm UTC](https://discuss.elastic.co/t/winlogbeats-missing-events-from-forwardedevents-channel/224296 "2020-03-19T17:21:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [March 19, 2020, 5:21pm UTC](https://discuss.elastic.co/t/winlogbeats-missing-events-from-forwardedevents-channel/224296/1 "2020-03-19T17:21:06Z")

</div>

Hello !

I noticed that some logs are missing when I collect the channel "Forwarded Events" of my central log collector

Here is my test.

1-Logs are well forwarded from my client (SRV-2012) to the central log collector (W2012-COLLECTOR) :

 ![Forwarded_Events](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75ee61a77107af609dc3ee9afdec9822156d24b8.png)

2-Only few logs are received in Kibana :

 ![Received_Events](https://us1.discourse-cdn.com/elastic/original/3X/5/9/593ba8d2dded6fd90bd9416bbfb9476e4db9895e.png)

3-Here is the misisng events :

 ![Missing_Events](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5c4d3c8c8e66702a70590a51ad478fa5a72f4b0.png)

It looks like it works better with own logs of the central log collector. To test I generated logon error and all have been received

I saw this github issue : [https://github.com/elastic/beats/issues/3731](https://github.com/elastic/beats/issues/3731) but didn't helped me

Did you have the same behavior ? Do you know a workaround or a fix ?

Thanks for your help ! 🙂

---

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [March 20, 2020, 4:07pm UTC](https://discuss.elastic.co/t/winlogbeats-missing-events-from-forwardedevents-channel/224296/2 "2020-03-20T16:07:08Z")

</div>

Anyone ?

I did some more tests with the own security channel of the central log collector and no events are missing. So issue is on the Forwarded Events channel, but this is strange than only few people have noticed this

I also compared with nxlogs and with this tool no events are missing from Forwarded Events channel, but I would like to use WinLogBeats because I can have fields in ECS format and so use Elastic SIEM

---

<div class="post-metadata">

**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\
**Post date:** [March 23, 2020, 3:56pm UTC](https://discuss.elastic.co/t/winlogbeats-missing-events-from-forwardedevents-channel/224296/3 "2020-03-23T15:56:50Z")

</div>

OK. Solved. In my setup, WinLogBeats send logs to Kafkfa, then to Logstash. After more analysis, issue was between Kafka and Logstash. For a unknown reason, some events was not consumed by Logstash Kafka input. I created a new topic and no more issue 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2020, 5:57pm UTC](https://discuss.elastic.co/t/winlogbeats-missing-events-from-forwardedevents-channel/224296/4 "2020-04-20T17:57:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.