Use legacy collection to send monitoring data

In Winlogbeat version 7.1 and earlier, you configured internal collectors that sent monitoring data to the production cluster, which would either index the data locally, or forward the data to a dedicated monitoring cluster via HTTP exporters.

Starting in Winlogbeat version 7.2, legacy collection settings are deprecated and will be removed in version 8.0.0. Instead of sending monitoring data to your production cluster, it’s recommended that you use the configuration described under internal collection to route monitoring data directly to your monitoring cluster.

Or as an alternative to internal collection, use Use Metricbeat collection.