Wrong indices, every second

[fooc (sander van der Laan)]

Hi,

When i start winlogbeat and use logstash or direct output to my elk every second an indices is created with wrong timestamps and the server crashes.

I think something is wrong with the date notation but i cannot find it.

Every second am indice is generated and it counts the days as seconds.

[andrewkroh]

Sounds like it could be an issue with your LS config. Please post the config you are using for both LS and Winlogbeat.

[fooc (sander van der Laan)]

I found it, it was processing the whole event log, when i set the config to 1 day everything is ok.