Cannot start File beat in windows

Elastic Stack Beats
1

Hi, I'm trying to configure filebeat in windows 2012 R2 to send logs to a ubuntu server where the logstash and kibana are configured. when i try to start filebeat in windows i get the error:
ERROR 1053: The service did not respond to the start or control request in timely fashion.

when I run config test, it comes okay:
PS C:\Program Files\Filebeat> .\filebeat.exe -c filebeat.yml -configtest
Config OK

when I try to check in debug mode it works fine:
PS C:\Program Files\Filebeat> .\filebeat.exe -c filebeat.yml -e -v -d "*"
2017/01/10 19:36:19.273991 beat.go:267: INFO Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Fileb
eat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs]
2017/01/10 19:36:19.273991 beat.go:177: INFO Setup Beat: filebeat; Version: 5.1.1
2017/01/10 19:36:19.274990 processor.go:43: DBG Processors:
2017/01/10 19:36:19.274990 beat.go:183: DBG Initializing output plugins
2017/01/10 19:36:19.273991 logp.go:219: INFO Metrics logging every 30s
2017/01/10 19:36:19.274990 logstash.go:90: INFO Max Retries set to: 3
2017/01/10 19:36:19.274990 outputs.go:106: INFO Activated logstash as output plugin.
2017/01/10 19:36:19.274990 publish.go:234: DBG Create output worker
2017/01/10 19:36:19.274990 publish.go:276: DBG No output is defined to store the topology. The server fields might not
be filled.
2017/01/10 19:36:19.275990 publish.go:291: INFO Publisher name: intercept-2012
2017/01/10 19:36:19.277990 async.go:63: INFO Flush Interval set to: 1s
2017/01/10 19:36:19.277990 async.go:64: INFO Max Bulk Size set to: 2048
2017/01/10 19:36:19.277990 async.go:72: DBG create bulk processing worker (interval=1s, bulk size=2048)
2017/01/10 19:36:19.277990 beat.go:207: INFO filebeat start running.
2017/01/10 19:36:19.277990 registrar.go:85: INFO Registry file set to: C:\Program Files\Filebeat\data\registry
2017/01/10 19:36:19.278991 registrar.go:106: INFO Loading registrar data from C:\Program Files\Filebeat\data\registry
2017/01/10 19:36:19.277990 service_windows.go:51: DBG Windows is interactive: true
2017/01/10 19:36:19.279990 registrar.go:131: INFO States Loaded from registrar: 5
2017/01/10 19:36:19.280991 crawler.go:34: INFO Loading Prospectors: 1
2017/01/10 19:36:19.281990 prospector_log.go:41: DBG exclude_files: []
2017/01/10 19:36:19.281990 state.go:64: DBG New state added for C:\Windows\System32\LogFiles\AGMedia\work.20170110kjjjj
j.log

But I'm not able to start the service. tried uninstalling and installing the service again with the ps1 but no luck.
Please Help.!!!

2

Are this all the lines you get in the log? Or do you have some more afterwards? If yes, could you share them in an gist?

3

here is the file:

4

When I run this: .\filebeat.exe -c filebeat.yml -e -v -d "*"
I can see the logs in kibana. but to run filebeat as a service, I have trouble.

https://gist.github.com/anonymous/db07f3154d394ebfbf325333e94d887d

5

Does the error throws directly after you start the service or after ~5~10 seconds? Can you also please post the start params for the service.

1 Like
6

Under which account the service is starting. LocalSystem?? Maybe the service account has no permission on the folder/file. Please check this too.

7

Thanks for your reply. I did everything under one account that is admin. the service doesn't start.
I just get the error 1053.
I see this when I check the properties of the service:
"C:\Program Files\Filebeat\filebeat.exe" -c "C:\Program Files\Filebeat\filebeat.yml" -path.home "C:\Program Files\Filebeat" -path.data "C:\ProgramData\filebeat"

8

And the error pops up directly or with a delay?

9

What i meant is what account is explicitly set in the service.

10

There is no delay it comes up right away. the account is administrator

11

Can you change the account to LocalSystem and try if this helps.

12

sorry for late reply. yes i tried with local account as well. but I still get the same error.

13

Can you try to install in to another folder. Not Programm Files. Better on another drive. I think it is an rights management problem to start the service.

14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.