# Can't start the filebeat for windows **URL:** \ **Category:** Beats\ **Created:** [March 9, 2018, 8:16am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217 "2018-03-09T08:16:41Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 9, 2018, 8:16am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/1 "2018-03-09T08:16:41Z")
I am just new to elastic. my elasticsearch is up and kibana is up too. however, I can't start my Filebeat to load the log into elastic. I can't start the filebeat services. When I run this C:\Program Files\filebeat\>.\filebeat.exe -c filebeat.yml -e I had the following error at the last line of the log: ERROR instance/beat.go:667 Exiting: Error in initing prospector: No paths were defined for prospector accessing 'filebeat.prospectors.0' (source:'filebeat.yml') Exiting: Error in initing prospector: No paths were defined for prospector accessing 'filebeat.prospectors.0' (source:'filebeat.yml') my filebeat.yml just setup as below: very simple filebeat.prospectors: - type: log enabled: true paths: - c:\temp\log\* need your advise. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 9, 2018, 8:20am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/2 "2018-03-09T08:20:04Z")
.yml files are sensitive to indentation, so make sure you have followed [the examples in the docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration.html) closely. It is hard to tell if your config is correct or not as you have not formatted the post correctly. ---
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 9, 2018, 8:24am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/3 "2018-03-09T08:24:28Z")
my setup as : - type: log enabled: true paths: - c:\temp\log\* setup.kibana: host: "localhost:5601" output.elasticsearch: hosts: ["localhost:9200"] # Optional protocol and basic auth credentials. # protocol: "https" username: "elastic" password: "elastic" ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 9, 2018, 8:25am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/4 "2018-03-09T08:25:22Z")
Can you format the config using the `` control in the UI? ---
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 9, 2018, 8:27am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/5 "2018-03-09T08:27:01Z")
my setup as : - type: log enabled: true paths: - c:\temp\log\* setup.kibana: host: "localhost:5601" output.elasticsearch: hosts: ["localhost:9200"] username: "elastic" password: "elastic" ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 9, 2018, 8:30am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/6 "2018-03-09T08:30:22Z")
It is still not correctly formatted, but it looks like you have an issue with indentation. As per the docs it should look something like this: ```auto filebeat.prospectors: - type: log enabled: true paths: - C:/temp/log* ``` ---
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 9, 2018, 8:32am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/7 "2018-03-09T08:32:42Z")
sample as : - c:\programdata\elasticsearch\logs\* windows is using "" not "/" which I use - c:\temp\log\* ---
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 9, 2018, 8:34am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/8 "2018-03-09T08:34:20Z")
same error if I am using -c:/temp/log/\* ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 9, 2018, 9:10am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/9 "2018-03-09T09:10:13Z")
Please post your config with proper formatting or store it in a gist and share the link. ---
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 9, 2018, 9:19am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/10 "2018-03-09T09:19:36Z")
here is my filebeat.yml config: / ###################### Filebeat Configuration Example ######################### / # This file is an example configuration file highlighting only the most common / # options. The filebeat.reference.yml file from the same directory contains all the / # supported options with more comments. You can use it as a reference. / #=========================== Filebeat prospectors ============================= filebeat.prospectors: / # Each - is a prospector. Most options can be set at the prospector level, so / # you can use different prospectors for various configurations. / # Below are the prospector specific configurations. - type: log / # Change to true to enable this prospector configuration. enabled: true / # Paths that should be crawled and fetched. Glob based paths. paths: - c:/temp/log/_.log / # - /var/log/_.log / #- c:\programdata\elasticsearch\logs\* / #============================= Filebeat modules =============================== filebeat.config.modules: / # Glob pattern for configuration loading path: ${path.config}/modules.d/\*.yml / # Set to true to enable config reloading reload.enabled: false / # Period on which files under path should be checked for changes / #reload.period: 10s / #==================== Elasticsearch template setting ========================== setup.template.settings: index.number\_of\_shards: 3 / #index.codec: best\_compression / #\_source.enabled: false / #============================== Kibana ===================================== setup.kibana: / # Kibana Host / # Scheme and port can be left out and will be set to the default (http and 5601) / # In case you specify and additional path, the scheme is required: [http://localhost:5601/path](http://localhost:5601/path) / # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601 host: "localhost:5601" / #================================ Outputs ===================================== / # Configure what output to use when sending the data collected by the beat. / #-------------------------- Elasticsearch output ------------------------------ output.elasticsearch: / # Array of hosts to connect to. hosts: ["localhost:9200"] / # Optional protocol and basic auth credentials. / # protocol: "https" username: "elastic" password: "elastic" / #----------------------------- Logstash output -------------------------------- / #================================ Logging ===================================== / # Sets log level. The default log level is info. / # Available log levels are: error, warning, info, debug logging.level: debug / # At debug level, you can selectively enable logging only for some components. / # To enable all selectors use ["_"]. Examples of other selectors are "beat", / # "publish", "service". / #logging.selectors: ["_"] ---
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 9, 2018, 9:21am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/11 "2018-03-09T09:21:30Z")
2018-03-09T14:21:01.041+0800 INFO instance/beat.go:468 Home path: [C:\Program Files\filebeat] Config path: [C:\Program Files\filebeat] Data path: [C:\Program Files\filebeat\data] Logs path: [C:\Program Files\filebeat\logs] 2018-03-09T14:21:01.295+0800 DEBUG [beat] instance/beat.go:495 Beat metadata path: C:\Program Files\filebeat\data\meta.json 2018-03-09T14:21:01.296+0800 INFO instance/beat.go:475 Beat UUID: dd9885cd-c582-4450-bfa9-41272d5439e0 2018-03-09T14:21:01.296+0800 INFO instance/beat.go:213 Setup Beat: filebeat; Version: 6.2.2 2018-03-09T14:21:01.296+0800 DEBUG [beat] instance/beat.go:230 Initializing output plugins 2018-03-09T14:21:01.296+0800 DEBUG [processors] processors/processor.go:49 Processors: 2018-03-09T14:21:01.296+0800 INFO elasticsearch/client.go:145 Elasticsearch url: [http://localhost:9200](http://localhost:9200) 2018-03-09T14:21:01.298+0800 INFO pipeline/module.go:76 Beat name: FAPLSG10010453 2018-03-09T14:21:01.300+0800 INFO elasticsearch/client.go:145 Elasticsearch url: [http://localhost:9200](http://localhost:9200) 2018-03-09T14:21:01.300+0800 INFO instance/beat.go:301 filebeat start running. 2018-03-09T14:21:01.300+0800 INFO [monitoring] log/log.go:97 Starting metrics logging every 30s 2018-03-09T14:21:01.300+0800 INFO elasticsearch/elasticsearch.go:154 Start monitoring endpoint init loop. 2018-03-09T14:21:01.300+0800 DEBUG [monitoring] elasticsearch/client.go:42 Monitoring client: connect. 2018-03-09T14:21:01.300+0800 DEBUG [elasticsearch] elasticsearch/client.go:708 GET [http://localhost:9200/\_xpack?filter\_path=features.monitoring.enabled](http://localhost:9200/_xpack?filter_path=features.monitoring.enabled) 2018-03-09T14:21:01.300+0800 DEBUG [service] service/service\_windows.go:51 Windows is interactive: true 2018-03-09T14:21:01.301+0800 DEBUG [registrar] registrar/registrar.go:88 Registry file set to: C:\Program Files\filebeat\data\registry 2018-03-09T14:21:01.303+0800 INFO registrar/registrar.go:108 Loading registrar data from C:\Program Files\filebeat\data\registry 2018-03-09T14:21:01.303+0800 INFO registrar/registrar.go:119 States Loaded from registrar: 0 2018-03-09T14:21:01.303+0800 INFO crawler/crawler.go:48 Loading Prospectors: 1 2018-03-09T14:21:01.303+0800 DEBUG [registrar] registrar/registrar.go:150 Starting Registrar 2018-03-09T14:21:01.304+0800 DEBUG [processors] processors/processor.go:49 Processors: 2018-03-09T14:21:01.304+0800 INFO crawler/crawler.go:109 Stopping Crawler 2018-03-09T14:21:01.304+0800 INFO crawler/crawler.go:119 Stopping 0 prospectors 2018-03-09T14:21:01.304+0800 INFO crawler/crawler.go:135 Crawler stopped 2018-03-09T14:21:01.304+0800 INFO registrar/registrar.go:210 Stopping Registrar 2018-03-09T14:21:01.304+0800 INFO registrar/registrar.go:165 Ending Registrar 2018-03-09T14:21:01.304+0800 DEBUG [registrar] registrar/registrar.go:228 Write registry file: C:\Program Files\filebeat\data\registry 2018-03-09T14:21:01.318+0800 DEBUG [registrar] registrar/registrar.go:253 Registry file updated. 0 states written. 2018-03-09T14:21:01.318+0800 INFO instance/beat.go:308 filebeat stopped. 2018-03-09T14:21:01.575+0800 INFO [monitoring] log/log.go:132 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":202,"time":202},"total":{"ticks":311,"time":311,"value":311},"user":{"ticks":109,"time":109}},"info":{"ephemeral\_id":"d2c012f5-b23e-44cc-92aa-0732ab49169e","uptime":{"ms":745}},"memstats":{"gc\_next":4194304,"memory\_alloc":1469736,"memory\_total":3100144,"rss":18964480}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0},"writes":1},"system":{"cpu":{"cores":4}},"xpack":{"monitoring":{"pipeline":{"clients":1}}}}}} 2018-03-09T14:21:01.575+0800 INFO [monitoring] log/log.go:133 Uptime: 745.022ms 2018-03-09T14:21:01.575+0800 INFO [monitoring] log/log.go:110 Stopping metrics logging. 2018-03-09T14:21:01.680+0800 ERROR instance/beat.go:667 Exiting: Error in initing prospector: No paths were defined for prospector accessing 'filebeat.prospectors.0' (source:'filebeat.yml') ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [March 9, 2018, 9:54am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/12 "2018-03-09T09:54:02Z")
Check the indentation. As you are not able to format the config correctly when posting, and the issue likely is in the details, I do unfortunately not think I will be able to help any further. ---
**Author:** ![Jeevanantham\_A](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@Jeevanantham\_A](https://discuss.elastic.co/u/Jeevanantham_A)\ **Post date:** [March 24, 2018, 5:45pm UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/13 "2018-03-24T17:45:51Z")
@Christian_Dahlqvist , am also having the same issue Logged it in : [https://stackoverflow.com/questions/49467828/filebeat-not-starting-in-windows](https://stackoverflow.com/questions/49467828/filebeat-not-starting-in-windows) As you mentioned i have validated the yml format of filebeats.yml files it correct, but still getting error regarding path setup ---
**Author:** ![KWLam](https://avatars.discourse-cdn.com/v4/letter/k/90ced4/32.png) [@KWLam](https://discuss.elastic.co/u/KWLam)\ **Post date:** [March 26, 2018, 10:41am UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/14 "2018-03-26T10:41:42Z")
Problem fixed thanks. Somehow the yml file corrupted, unzip the new file in, it work. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 23, 2018, 12:41pm UTC](https://discuss.elastic.co/t/cant-start-the-filebeat-for-windows/123217/15 "2018-04-23T12:41:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.