# Cannot create a file when that file already exists

**URL:** <https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 2, 2020, 9:31am UTC](https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303 "2020-06-02T09:31:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bob88](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@bob88](https://discuss.elastic.co/u/bob88)\
**Post date:** [June 2, 2020, 9:31am UTC](https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303/1 "2020-06-02T09:31:33Z")

</div>

Hello,

i have a problem with winlogbeat 7.6 on windows 2008r2:

"ERROR instance/beat.go:933  
Exiting: rename C:\ProgramData\winlogbeat.winlogbeat.yml.new C:\ProgramData\winlogbeat.winlogbeat.yml:  
Cannot create a file when that file already exists.

The service stop and don't want to restart. i have tried to delete winlogbeat.yml and restart the service but it doesn't work.

Can you help me please ?

regards

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [June 2, 2020, 2:24pm UTC](https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303/2 "2020-06-02T14:24:24Z")

</div>

Could you please share your configuration as text formatted using `</>`?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [June 2, 2020, 3:59pm UTC](https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303/4 "2020-06-02T15:59:33Z")

</div>

Could you please format the configuration using `</>`? When pasting configuration without the formatting, the whitespaces are lost which can lead to config problem.

---

<div class="post-metadata">

**Author:** ![bob88](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@bob88](https://discuss.elastic.co/u/bob88)\
**Post date:** [June 3, 2020, 7:24am UTC](https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303/5 "2020-06-03T07:24:02Z")

</div>

`winlogbeat.event_logs:`  
` - name: Application`  
`ignore_older: 72h`

`- name: System`

`- name: Security`  
`processors:`  
`- script:`  
`lang: javascript`  
`id: security`  
`file: ${path.home}/module/security/config/winlogbeat-security.js`

`- name: Microsoft-Windows-Sysmon/Operational`  
`processors:`  
`- script:`  
`lang: javascript`  
`id: sysmon`  
`file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js`

`#==================== Elasticsearch template settings ==========================`

`setup.template.settings:`  
`#index.number_of_shards: 1`  
`#index.codec: best_compression`  
`#_source.enabled: false`

`#================================ General =====================================`

`name: HOSTXXX`

`#============================== Kibana =====================================`

` # Kibana Host`  
`host: "10.X.X.X:5601"`

`#================================ Outputs =====================================`

`#-------------------------- Elasticsearch output ------------------------------`  
`output.elasticsearch:`  
` hosts: ["10.X.X.X:9200"]`

`#protocol: "https"

` username: "elastic"`  
`password: "12345678"`

`#================================ Processors =====================================`

`processors:`  
`- add_host_metadata: ~`  
`- add_cloud_metadata: ~`  
` - add_docker_metadata: ~`

`#============================== X-Pack Monitoring ===============================`

`monitoring.enabled: true`

`monitoring.cluster_uuid: 'XXX'`

`monitoring.elasticsearch:`

---

<div class="post-metadata">

**Author:** ![bob88](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@bob88](https://discuss.elastic.co/u/bob88)\
**Post date:** [June 9, 2020, 11:15am UTC](https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303/6 "2020-06-09T11:15:20Z")

</div>

Nobody have an idea?  
Why winlogbeat recreate winlogbeat.yml (.winlogbeat.yml.new) ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2020, 11:19am UTC](https://discuss.elastic.co/t/cannot-create-a-file-when-that-file-already-exists/235303/7 "2020-07-07T11:19:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.