winlogbeat can't read evtx file continuing

[yueguiji]

In my case，I used the winlogbeat to read evtx file ;
In the beginning it's good for task ，the evtx file be read quickly.
But Suddenly I find a question - If the evtx file be write all the time（for example C:\Windows\System32\winevt\Logs\Security.evtx），the winlogbeat just read to winlogbeat's start time ,so I need restart the winlogbeat for read all data.

How to solve this question?

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

The .extx reading feature is meant for use with archived logs. If you want to read from the active Security channel then configure Winlogbeat to read from the channel rather than a file.

winlogbeat.event_logs:
  - name: Security

[yueguiji]

The .extx reading feature is meant for use with archived logs. If you want to read from the active Security channel then configure Winlogbeat to read from the channel rather than a file.

winlogbeat.event_logs:
  - name: Security

the evtx file was shared in my computer like \\it-data\log\xxx_last.evtx
this isn't a local disk.so I can't read as channel

[yueguiji]

The .extx reading feature is meant for use with archived logs. If you want to read from the active Security channel then configure Winlogbeat to read from the channel rather than a file.

winlogbeat.event_logs:
  - name: Security

I try to fix this question for my code.
but I see a new question if the evtx file over 2G than change a new file use same name.
In the case the exe will be shutdown.

It's too hard to work.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)