# \`agent.logging.to\_eventlog: true\` fails with "appName cannot be empty" even when running as Windows service

**URL:** <https://discuss.elastic.co/t/agent-logging-to-eventlog-true-fails-with-appname-cannot-be-empty-even-when-running-as-windows-service/385096>\
**Category:** Elastic Agent\
**Created:** [February 18, 2026, 12:39pm UTC](https://discuss.elastic.co/t/agent-logging-to-eventlog-true-fails-with-appname-cannot-be-empty-even-when-running-as-windows-service/385096 "2026-02-18T12:39:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![vasek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vasek/32/136636_2.png) [@vasek](https://discuss.elastic.co/u/vasek)\
**Post date:** [February 18, 2026, 12:39pm UTC](https://discuss.elastic.co/t/agent-logging-to-eventlog-true-fails-with-appname-cannot-be-empty-even-when-running-as-windows-service/385096/1 "2026-02-18T12:39:48Z")

</div>

**Environment:**

- Elastic Agent: 9.1.10 (build: 45f734)
- OS: Windows Server 2022
- Mode: Standalone (no Fleet)

**Problem:**

Setting `agent.logging.to_eventlog: true` in `elastic-agent.yml` causes agent to fail on startup with:

```auto
elastic-agent.exe run failed: failed to create logger: error initializing logging: failed to build log output: appName cannot be empty

```

**Steps to reproduce:**

1. Install agent as Windows service:

```powershell
.\elastic-agent.exe install

```

1. Set in `elastic-agent.yml`:

```yaml
agent.logging.level: info
agent.logging.to_eventlog: true
agent.logging.to_files: false

```

1. Start service via `services.msc` → agent fails immediately with the error above.

**The Event Log source IS registered.** Confirmed by PowerShell:

```powershell
PS C:\Windows\system32> New-EventLog -LogName Application -Source "Elastic Agent"
New-EventLog : The "Elastic Agent" source is already registered on the "localhost" computer.

```

So the Windows Event Log source exists — but the agent still fails with `appName cannot be empty`.

**Workaround:**

Use file logging instead:

```yaml
agent.logging.to_eventlog: false
agent.logging.to_files: true
agent.logging.files:
  path: 'C:\ProgramData\Elastic\Agent\logs'
  name: elastic-agent
  keepfiles: 7

```

**Question:**

Is there any way to make `to_eventlog: true` work with standalone Elastic Agent on Windows Server 2022? Or is this a known bug?

Any workaround other than file logging would be appreciated.