Cannot start File beat in windows


(Dharma Teja Koneru) #1

Hi, I'm trying to configure filebeat in windows 2012 R2 to send logs to a ubuntu server where the logstash and kibana are configured. when i try to start filebeat in windows i get the error:
ERROR 1053: The service did not respond to the start or control request in timely fashion.

when I run config test, it comes okay:
PS C:\Program Files\Filebeat> .\filebeat.exe -c filebeat.yml -configtest
Config OK

when I try to check in debug mode it works fine:
PS C:\Program Files\Filebeat> .\filebeat.exe -c filebeat.yml -e -v -d "*"
2017/01/10 19:36:19.273991 beat.go:267: INFO Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Fileb
eat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs]
2017/01/10 19:36:19.273991 beat.go:177: INFO Setup Beat: filebeat; Version: 5.1.1
2017/01/10 19:36:19.274990 processor.go:43: DBG Processors:
2017/01/10 19:36:19.274990 beat.go:183: DBG Initializing output plugins
2017/01/10 19:36:19.273991 logp.go:219: INFO Metrics logging every 30s
2017/01/10 19:36:19.274990 logstash.go:90: INFO Max Retries set to: 3
2017/01/10 19:36:19.274990 outputs.go:106: INFO Activated logstash as output plugin.
2017/01/10 19:36:19.274990 publish.go:234: DBG Create output worker
2017/01/10 19:36:19.274990 publish.go:276: DBG No output is defined to store the topology. The server fields might not
be filled.
2017/01/10 19:36:19.275990 publish.go:291: INFO Publisher name: intercept-2012
2017/01/10 19:36:19.277990 async.go:63: INFO Flush Interval set to: 1s
2017/01/10 19:36:19.277990 async.go:64: INFO Max Bulk Size set to: 2048
2017/01/10 19:36:19.277990 async.go:72: DBG create bulk processing worker (interval=1s, bulk size=2048)
2017/01/10 19:36:19.277990 beat.go:207: INFO filebeat start running.
2017/01/10 19:36:19.277990 registrar.go:85: INFO Registry file set to: C:\Program Files\Filebeat\data\registry
2017/01/10 19:36:19.278991 registrar.go:106: INFO Loading registrar data from C:\Program Files\Filebeat\data\registry
2017/01/10 19:36:19.277990 service_windows.go:51: DBG Windows is interactive: true
2017/01/10 19:36:19.279990 registrar.go:131: INFO States Loaded from registrar: 5
2017/01/10 19:36:19.280991 crawler.go:34: INFO Loading Prospectors: 1
2017/01/10 19:36:19.281990 prospector_log.go:41: DBG exclude_files: []
2017/01/10 19:36:19.281990 state.go:64: DBG New state added for C:\Windows\System32\LogFiles\AGMedia\work.20170110kjjjj
j.log

But I'm not able to start the service. tried uninstalling and installing the service again with the ps1 but no luck.
Please Help.!!!


(ruflin) #2

Are this all the lines you get in the log? Or do you have some more afterwards? If yes, could you share them in an gist?


(Dharma Teja Koneru) #3

here is the file:


(Dharma Teja Koneru) #4

When I run this: .\filebeat.exe -c filebeat.yml -e -v -d "*"
I can see the logs in kibana. but to run filebeat as a service, I have trouble.

https://gist.github.com/anonymous/db07f3154d394ebfbf325333e94d887d


(Maddin2016) #5

Does the error throws directly after you start the service or after ~5~10 seconds? Can you also please post the start params for the service.


(Maddin2016) #6

Under which account the service is starting. LocalSystem?? Maybe the service account has no permission on the folder/file. Please check this too.


(Dharma Teja Koneru) #7

Thanks for your reply. I did everything under one account that is admin. the service doesn't start.
I just get the error 1053.
I see this when I check the properties of the service:
"C:\Program Files\Filebeat\filebeat.exe" -c "C:\Program Files\Filebeat\filebeat.yml" -path.home "C:\Program Files\Filebeat" -path.data "C:\ProgramData\filebeat"


(Maddin2016) #8

And the error pops up directly or with a delay?


(Maddin2016) #9

What i meant is what account is explicitly set in the service.


(Dharma Teja Koneru) #10

There is no delay it comes up right away. the account is administrator


(Maddin2016) #11

Can you change the account to LocalSystem and try if this helps.


(Dharma Teja Koneru) #12

sorry for late reply. yes i tried with local account as well. but I still get the same error.


(Maddin2016) #13

Can you try to install in to another folder. Not Programm Files. Better on another drive. I think it is an rights management problem to start the service.


(system) #14

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.