Beats 8.13.1 services won't start due to quoting issues

[Aaron_C_de_Bruyn]

In reference to:

Revent Windows Service Changes c:\programdata\?

We have recently added support for customizing the installdir property of the MSI Allow overriding INSTALLDIR by amitkanfer · Pull Request #241 · elastic/elastic-stack-installers · GitHub I'll have to double check what version we expect the installdir support to land in (I think 8.13) but that will allow you to place the installation directory on disk, using an MSI cmdline flag, without the version in the path via something like msiexec /i "<full path to msi file>" \qn INSTALLDIR="C:\Program Fi…

It looks like the MSI installers now support passing INSTALLDIR...but it looks like the beats don't handle quoting properly and cause services to fail to start.

Just tried to install Auditbeat, Metricbeat, and Winlogbeat 8.13.1 and all the services fail to start.

Copying the start string from the services throws errors showing quotes in the wrong spots.

Removing the quotes allows the beats to start up properly.

[Aaron_C_de_Bruyn]

I should note that his issue might occur in other beat versions. We're upgrading from 8.11.1 to 8.13.1.

[Aaron_C_de_Bruyn]

Confirmed that removing the quotes from:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winlogbeat\ImagePath

Allows the services to start up properly. This won't help people who have installed to paths containing spaces (i.e. "c:\Program Files")

[strawgate (William Easton)]

Can you please share what you passed to InstallDir? Preferably the full msiexec command?

[Aaron_C_de_Bruyn]

msiexec /i https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-8.13.1-windows-x86_64.msi INSTALLDIR=c:\beats\winlogbeat\ /qn /norestart

I tried quoting it as well (INSTALLDIR="c:\beats\winlogbeat") and still ran into problems.

[strawgate (William Easton)]

Thanks for reporting this, we'll work on a fix shortly.

If you have the ability to run a command after the install you can workaround this issue by running sc to modify the binpath:

sc config winlogbeat binpath= "\"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\winlogbeat.exe\" --path.home \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\" --path.config \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\" --path.data \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\data\" --path.logs \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\logs\" -E logging.files.redirect_stderr=true"

Changing the paths to match your custom path

[strawgate (William Easton)]

You can follow the fix here: Remove trailing slash and store data and logs in subfolders by strawgate · Pull Request #264 · elastic/elastic-stack-installers · GitHub

[Aaron_C_de_Bruyn]

No worries--we use saltstack for deployment. We already pushed out updated registry keys as a work-around.