Skip to content

Commit

Permalink
Update experimental flag on winlogbeat documentation (#25207) (#25242)
Browse files Browse the repository at this point in the history
- remove experimental from batch_read_size
- remove experimental from api (using wineventlog-experimental) is
  still experimental but setting the API isn't
- syncs with documentation for agent winlog input

(cherry picked from commit 639998c)

Co-authored-by: Lee Hinman <57081003+leehinman@users.noreply.github.com>
  • Loading branch information
mergify[bot] and leehinman authored Apr 22, 2021
1 parent a1a93dd commit 17ad7b8
Showing 1 changed file with 1 addition and 5 deletions.
6 changes: 1 addition & 5 deletions winlogbeat/docs/winlogbeat-options.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,6 @@ winlogbeat.event_logs:
[float]
==== `event_logs.batch_read_size`

experimental[]

The maximum number of event log records to read from the Windows API in a single
batch. The default batch size is 100. Most Windows versions return an error if
the value is larger than 1024. *{vista_and_newer}*
Expand Down Expand Up @@ -414,12 +412,10 @@ example of how to read from an `.evtx` file in the <<reading-from-evtx,FAQ>>.
[float]
==== `event_logs.api`

experimental[]

This selects the event log reader implementation that is used to read events
from the Windows APIs. You should only set this option when testing experimental
features. When the value is set to `wineventlog-experimental` Winlogbeat will
replace the default event log reader with the experimental implementation.
replace the default event log reader with the **experimental** implementation.
We are evaluating this implementation to see if it can provide increased
performance and reduce CPU usage. *{vista_and_newer}*

Expand Down

0 comments on commit 17ad7b8

Please sign in to comment.