If your WEC server loses connectivity with the AARNET SIEM, logs will be backed up on local storage until the connectivity is restored. Then Winlogbeat will resume sending logs through. The amount of logs to be retained on local storage will depend on the disk size and volume of incoming logs.
