Skip to content

Commit

Permalink
Update experimental flag on winlogbeat documentation (#25207)
Browse files Browse the repository at this point in the history
- remove experimental from batch_read_size
- remove experimental from api (using wineventlog-experimental) is
  still experimental but setting the API isn't
- syncs with documentation for agent winlog input
  • Loading branch information
leehinman committed Apr 22, 2021
1 parent 2f104b8 commit 639998c
Showing 1 changed file with 1 addition and 5 deletions.
6 changes: 1 addition & 5 deletions winlogbeat/docs/winlogbeat-options.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,6 @@ winlogbeat.event_logs:
[float]
==== `event_logs.batch_read_size`

experimental[]

The maximum number of event log records to read from the Windows API in a single
batch. The default batch size is 100. Most Windows versions return an error if
the value is larger than 1024. *{vista_and_newer}*
Expand Down Expand Up @@ -414,12 +412,10 @@ example of how to read from an `.evtx` file in the <<reading-from-evtx,FAQ>>.
[float]
==== `event_logs.api`

experimental[]

This selects the event log reader implementation that is used to read events
from the Windows APIs. You should only set this option when testing experimental
features. When the value is set to `wineventlog-experimental` Winlogbeat will
replace the default event log reader with the experimental implementation.
replace the default event log reader with the **experimental** implementation.
We are evaluating this implementation to see if it can provide increased
performance and reduce CPU usage. *{vista_and_newer}*

Expand Down

0 comments on commit 639998c

Please sign in to comment.