# Configuring FileBeat.yml For Windows **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 7, 2017, 7:46pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623 "2017-06-07T19:46:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![jshahid](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@jshahid](https://discuss.elastic.co/u/jshahid)\ **Post date:** [June 7, 2017, 7:46pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/1 "2017-06-07T19:46:44Z")
Hi, I have been looking for some time on how set up configuration of filebeat.yml on a windows client to ship logs to a ubuntu host that has the elk stack installed. I have the service installed and running, but am completely unsure of where to go from here. Thanks for the help ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 7, 2017, 8:05pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/2 "2017-06-07T20:05:09Z")
Have you tried following the [Getting Started Guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html) for Filebeat? ---
**Author:** ![jshahid](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@jshahid](https://discuss.elastic.co/u/jshahid)\ **Post date:** [June 7, 2017, 8:26pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/3 "2017-06-07T20:26:14Z")
Yes. But how do windows logs get to the directory shown in that example? Furthermore, when i un-comment the Windows path, I am unable to start the filebeat service. Error 1053 ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 7, 2017, 9:04pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/4 "2017-06-07T21:04:03Z")
> [@jshahid](#): > > But how do windows logs get to the directory shown in that example? It is assumed that you have applications that are producing log files that you want to read. Windows itself does not use log files to record events; it reports its events to its Event Log service (this is the data you view with the Window Event Viewer). To collect data from the Event Log service you would use Winlogbeat and not Filebeat. > [@jshahid](#): > > Furthermore, when i un-comment the Windows path, I am unable to start the filebeat service. Error 1053 You need to modify Filebeat's config file to point to the location(s) of the log files you want to collect. If the locations are not valid this will cause an error and Filebeat will not start. The errors will be recorded in the Filebeat log file. ---
**Author:** ![jshahid](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@jshahid](https://discuss.elastic.co/u/jshahid)\ **Post date:** [June 8, 2017, 12:18pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/5 "2017-06-08T12:18:35Z")
Alright, well. with winlogbeat... i get this: ``` 2017-06-08T08:15:50-04:00 ERR Failed to publish events caused by: EOF 2017-06-08T08:15:50-04:00 INFO Error publishing events (retrying): EOF 2017-06-08T08:16:01-04:00 ERR Connecting error publishing events (retrying): Get http:// *********** :9200: dial tcp X.X.X.X:9200: connectex: No connection could be made because the target machine actively refused it. ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 8, 2017, 12:30pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/6 "2017-06-08T12:30:35Z")
> [@jshahid](#): > > No connection could be made because the target machine actively refused it. The error seems to indicate that there is firewall blocking the connection. ---
**Author:** ![jshahid](https://avatars.discourse-cdn.com/v4/letter/j/65b543/32.png) [@jshahid](https://discuss.elastic.co/u/jshahid)\ **Post date:** [June 8, 2017, 7:32pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/7 "2017-06-08T19:32:40Z")
It turns out, server configuration was bad. I rebuilt the server and configured things for winlogbeat. I have logs sending from a client server to the host, but nothing showing up in kibana. Where should i be looking? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 7:33pm UTC](https://discuss.elastic.co/t/configuring-filebeat-yml-for-windows/88623/8 "2017-07-06T19:33:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.