beats
beats copied to clipboard
[winlogbeat] Windows event log XMLs are truncated if exceed 8KB
Winlogbeat is truncating Windows event log XMLs above 8KB. The event document contains RenderErr:[XML syntax error on line xxx: unexpected EOF]
in message
node.
The above error is caused by truncated XML. Winlogbeat is using EvtRender API with pre-allocated buffer for efficiency. Unfortunately this API can succeed returning truncated data in provided buffer.
For confirmed bugs, please report:
- Version: 8.15