# Beats 8.13.1 services won't start due to quoting issues **URL:** \ **Category:** Beats\ **Tags:** filebeat, metricbeat\ **Created:** [April 7, 2024, 4:54pm UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924 "2024-04-07T16:54:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Aaron\_C\_de\_Bruyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_c_de_bruyn/32/901_2.png) [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Post date:** [April 7, 2024, 4:54pm UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/1 "2024-04-07T16:54:43Z")
In reference to: > [@Revent Windows Service Changes c:\\programdata\\?](https://discuss.elastic.co/t/revent-windows-service-changes-c-programdata/353423/4): > > We have recently added support for customizing the installdir property of the MSI [Allow overriding INSTALLDIR by amitkanfer · Pull Request #241 · elastic/elastic-stack-installers · GitHub](https://github.com/elastic/elastic-stack-installers/pull/241) I'll have to double check what version we expect the installdir support to land in (I think 8.13) but that will allow you to place the installation directory on disk, using an MSI cmdline flag, without the version in the path via something like msiexec /i "\" \qn INSTALLDIR="C:\Program Fi… It looks like the MSI installers now support passing INSTALLDIR...but it looks like the beats don't handle quoting properly and cause services to fail to start. Just tried to install Auditbeat, Metricbeat, and Winlogbeat 8.13.1 and all the services fail to start. Copying the start string from the services throws errors showing quotes in the wrong spots. Removing the quotes allows the beats to start up properly. ![Screenshot from 2024-04-07 09-47-18](https://us1.discourse-cdn.com/elastic/original/3X/0/7/07faafb601ac494288311df9e1a8ede0737e928b.png) ---
**Author:** ![Aaron\_C\_de\_Bruyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_c_de_bruyn/32/901_2.png) [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Post date:** [April 7, 2024, 4:58pm UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/2 "2024-04-07T16:58:06Z")
I should note that his issue might occur in other beat versions. We're upgrading from 8.11.1 to 8.13.1. ---
**Author:** ![Aaron\_C\_de\_Bruyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_c_de_bruyn/32/901_2.png) [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Post date:** [April 7, 2024, 5:09pm UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/3 "2024-04-07T17:09:17Z")
Confirmed that removing the quotes from: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winlogbeat\ImagePath` Allows the services to start up properly. This won't help people who have installed to paths containing spaces (i.e. "c:\Program Files") ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [April 9, 2024, 3:30am UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/4 "2024-04-09T03:30:46Z")
Can you please share what you passed to InstallDir? Preferably the full msiexec command? ---
**Author:** ![Aaron\_C\_de\_Bruyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_c_de_bruyn/32/901_2.png) [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Post date:** [April 9, 2024, 3:49am UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/5 "2024-04-09T03:49:45Z")
`msiexec /i https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-8.13.1-windows-x86_64.msi INSTALLDIR=c:\beats\winlogbeat\ /qn /norestart` I tried quoting it as well (INSTALLDIR="c:\beats\winlogbeat") and still ran into problems. ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [April 9, 2024, 4:26pm UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/6 "2024-04-09T16:26:02Z")
Thanks for reporting this, we'll work on a fix shortly. If you have the ability to run a command after the install you can workaround this issue by running sc to modify the binpath: ```auto sc config winlogbeat binpath= "\"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\winlogbeat.exe\" --path.home \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\" --path.config \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\" --path.data \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\data\" --path.logs \"C:\Program Files\Elastic\Beats\8.13.2\winlogbeat\logs\" -E logging.files.redirect_stderr=true" ``` Changing the paths to match your custom path ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [April 9, 2024, 5:13pm UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/7 "2024-04-09T17:13:05Z")
You can follow the fix here: [Remove trailing slash and store data and logs in subfolders by strawgate · Pull Request #264 · elastic/elastic-stack-installers · GitHub](https://github.com/elastic/elastic-stack-installers/pull/264) ---
**Author:** ![Aaron\_C\_de\_Bruyn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron_c_de_bruyn/32/901_2.png) [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Post date:** [April 9, 2024, 6:15pm UTC](https://discuss.elastic.co/t/beats-8-13-1-services-wont-start-due-to-quoting-issues/356924/8 "2024-04-09T18:15:47Z")
No worries--we use saltstack for deployment. We already pushed out updated registry keys as a work-around.