# Can't start filebeat on windows-machine

**URL:** <https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 26, 2015, 6:38am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954 "2015-10-26T06:38:21Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![moo2k](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@moo2k](https://discuss.elastic.co/u/moo2k)\
**Post date:** [October 26, 2015, 6:38am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/1 "2015-10-26T06:38:21Z")

</div>

Hello, guys. I have installed and configured ElasticSearch, Logstash and Kibana on my windows-machine. I downloaded a FileBeat product. But I can't start filebeat service via PowerShell or manually. Service installs. but not run. It shows error #1053. How to fix that?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 26, 2015, 6:40am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/2 "2015-10-26T06:40:17Z")

</div>

Can you start Filebeat in a command prompt, i.e. not as a service?

---

<div class="post-metadata">

**Author:** ![moo2k](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@moo2k](https://discuss.elastic.co/u/moo2k)\
**Post date:** [October 26, 2015, 7:21am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/3 "2015-10-26T07:21:36Z")

</div>

@magnusbaeck I have successfully started the FileBeat. It was my fault in config file. I want to ship logs to logstash via FileBeat. But I get some abracadabra like this:

```
message:z%\u0005\x89]:\u0003iS\x97\x8C)\x9B\xFF\xBB\xA7\x8A\u000E\xE4\xDD\xD8\xCD> \x94\xB6\x9C<\xCF9?\x9E\x84\xBF\x9E\xCDf\x8Fp=ߒ\u0017\xBD\xCBva\xB3%fK\xFC\xB0p߉!\xDF\xFATq`\x8A2\xA0\\\x93\x92\xE4\u001F\xA3\xC3\xFF!.\xC9ϒ\xB4q=dbXI:\xEF\xC2\"\u00113\xACC\x98\xBE\x82\xF3C\u0017Q @version:1 @timestamp:2015-10-26T07:06:16.358Z host:127.0.0.1 _id:AVCi-A9mh6uRoz0aew7j _type:logs _index:logstash-2015.10.26

```

May be I have a mistake in encoding? Logs sample looks like:  
`2015-04-24 07:03:50.4307|INFO|YES|Start web application`

Logstash conf: [http://pastebin.com/4GYifA9Z](http://pastebin.com/4GYifA9Z)  
FileBeat conf: [http://pastebin.com/1nZYEmBz](http://pastebin.com/1nZYEmBz)

Thank you for your help.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [October 26, 2015, 10:20am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/4 "2015-10-26T10:20:27Z")

</div>

This definitively looks like an encoding issue. What is the encoding of the file you are crawling? Have a look at the config and search for encoding. You are able to configure per prospector what encoding should be used: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html)

---

<div class="post-metadata">

**Author:** ![moo2k](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@moo2k](https://discuss.elastic.co/u/moo2k)\
**Post date:** [October 26, 2015, 11:19am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/5 "2015-10-26T11:19:09Z")

</div>

@ruflin app writes logs in utf8-format. I have already defined an encoding field as "utf-8" . But result is same.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [October 26, 2015, 2:51pm UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/6 "2015-10-26T14:51:56Z")

</div>

@moo2k, this looks really weird for utf8. Is it possible for you to share the file as is (in private)?

---

<div class="post-metadata">

**Author:** ![moo2k](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@moo2k](https://discuss.elastic.co/u/moo2k)\
**Post date:** [November 9, 2015, 1:19am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/7 "2015-11-09T01:19:03Z")

</div>

It was my fault. I used tcp input instead of "beats" logstash input plugin. It is working now. Thanks to all.

---

<div class="post-metadata">

**Author:** ![prosenjit](https://avatars.discourse-cdn.com/v4/letter/p/e19adc/32.png) [@prosenjit](https://discuss.elastic.co/u/prosenjit)\
**Post date:** [February 2, 2017, 9:55am UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/8 "2017-02-02T09:55:06Z")

</div>

@moo2k how did you manage to start it as a service?? What was the issue in the config?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:50pm UTC](https://discuss.elastic.co/t/cant-start-filebeat-on-windows-machine/32954/9 "2017-07-05T21:50:01Z")

</div>