# Cannot get winlogbeats into logstash **URL:** \ **Category:** Logstash\ **Created:** [July 5, 2016, 11:55pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787 "2016-07-05T23:55:12Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Post date:** [July 5, 2016, 11:55pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/1 "2016-07-05T23:55:12Z")
i can show pictures of configurations if people need them. i think what is happening is elastic search is looking at loopback instead of eth0 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 6, 2016, 4:09am UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/2 "2016-07-06T04:09:12Z")
You haven't given us much to work with here. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 6, 2016, 5:31am UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/3 "2016-07-06T05:31:52Z")
We don't want pictures of anything, but we do need more details, like configuration, Winlogbeat logs, Logstash logs, etc. Chances are that you'll discover the problem while you're collecting that information. ---
**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Post date:** [July 6, 2016, 4:13pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/4 "2016-07-06T16:13:21Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/f/ff1a2789f22b7b5cd6b9cbc71d64aef401254cb8.png) so here is my .yaml file my conf file reads input{ beats{port =\> 5044}} output{elasticsearch{ hosts =\> ["localhost:9200"] index =\> "logstash-%{+YYY.MM.dd}" }} ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 6, 2016, 4:22pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/5 "2016-07-06T16:22:31Z")
You haven't provided any indication of the problem. Please provide logs from Winlogbeat and Logstash for starters. Have you followed the Winlogbeat [Getting Started guide](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html) which also includes a section on [how to setup Logstash for Beats](https://www.elastic.co/guide/en/beats/libbeat/1.2/logstash-installation.html#logstash-setup)? ---
**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Post date:** [July 6, 2016, 4:24pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/6 "2016-07-06T16:24:47Z")
The problem is winlogbeats is creating registry items in C;/programData like it is supposed to but nothing is getting into the elk stack. ---
**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Post date:** [July 6, 2016, 4:51pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/7 "2016-07-06T16:51:46Z")
when i run netstat -an | grep 5044 i only get tcp6 could that be a problem? ---
**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Post date:** [July 6, 2016, 5:58pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/8 "2016-07-06T17:58:08Z")
when i run logstash in the foreground all i get is this...... Settings: Default filter workers: 1 the error reported is: Address already in use - bind - Address already in use ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 6, 2016, 6:59pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/9 "2016-07-06T18:59:21Z")
Do you have anything else listening on port 5044, i.e. if you shut down Logstash is the port busy? Exactly how are you invoking Logstash? ---
**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Post date:** [July 6, 2016, 8:43pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/10 "2016-07-06T20:43:47Z")
i stopped logstash and then ran sudo /opt/logstash/bin/logstash -f /etc/logstash/conf.d and now i get this.. "Settings: Default filter workers: 1 Logstash startup completed" ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 6, 2016, 8:56pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/11 "2016-07-06T20:56:06Z")
Which means LS has started, that's good. ---
**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Post date:** [July 6, 2016, 8:57pm UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/12 "2016-07-06T20:57:51Z")
Now i am seeing my logstash items in elasticsearch so i think i got it working thanks guys 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/cannot-get-winlogbeats-into-logstash/54787/13 "2017-07-06T04:49:15Z")