# Elastic-agent 8.17.7: logs are not being harvested from .log files on Windows host

**URL:** <https://discuss.elastic.co/t/elastic-agent-8-17-7-logs-are-not-being-harvested-from-log-files-on-windows-host/379447>\
**Category:** Elastic Observability\
**Created:** [June 24, 2025, 6:18pm UTC](https://discuss.elastic.co/t/elastic-agent-8-17-7-logs-are-not-being-harvested-from-log-files-on-windows-host/379447 "2025-06-24T18:18:34Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 28, 2025, 12:22am UTC](https://discuss.elastic.co/t/elastic-agent-8-17-7-logs-are-not-being-harvested-from-log-files-on-windows-host/379447/6 "2025-06-28T00:22:18Z")

</div>

Hi @kiedis

Lets Back Up ... exactly how did you install Elastic Agent?

Did you follow the guided Installation from the Fleet UI?

It should look something like

 ![Screenshot 2025-06-27 at 5.19.59 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e0bfee7107c37a2e057d3cdfcce61f14ac194a87.png)

```auto
$ProgressPreference = 'SilentlyContinue'
Invoke-WebRequest -Uri https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.18.3-windows-x86_64.zip -OutFile elastic-agent-8.18.3-windows-x86_64.zip 
Expand-Archive .\elastic-agent-8.18.3-windows-x86_64.zip -DestinationPath .
cd elastic-agent-8.18.3-windows-x86_64
.\elastic-agent.exe install --url=https://sadfasdfasdfb3bd74c467.fleet.us-west1.gcp.cloud.es.io:443 --enrollment-token=asdfasdfasdfsh5NUk6dk9NUkphaUZRU0MwYWotZTIzdTU1Zw==

```

And if so if should install the Agent in

```auto
    Directory: C:\Program Files\Elastic\Agent

Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 3/12/2025 3:10 AM data
d----- 1/13/2025 7:36 PM vault
-a---- 1/13/2025 7:36 PM 41 .build_hash.txt
-a---- 2/28/2025 5:54 PM 6 .elastic-agent.active.commit
-a---- 1/13/2025 7:36 PM 0 .installed
-a---- 6/24/2025 12:19 PM 20972015 elastic-agent-20250623-1.ndjson
-a---- 6/25/2025 1:07 AM 20971666 elastic-agent-20250624.ndjson
-a---- 6/26/2025 2:44 AM 20972114 elastic-agent-20250625-1.ndjson
-a---- 6/25/2025 1:56 PM 20973411 elastic-agent-20250625.ndjson
-a---- 6/27/2025 4:21 AM 20972958 elastic-agent-20250626-1.ndjson
-a---- 6/26/2025 3:32 PM 20972571 elastic-agent-20250626.ndjson
-a---- 6/28/2025 12:18 AM 11719442 elastic-agent-20250627-1.ndjson
-a---- 6/27/2025 5:09 PM 20973053 elastic-agent-20250627.ndjson
-a---l 2/28/2025 5:54 PM 0 elastic-agent.exe
-a---- 1/13/2025 7:36 PM 14829 elastic-agent.reference.yml
-a---- 1/13/2025 7:36 PM 1947 elastic-agent.yml
-a---- 1/13/2025 7:36 PM 12306 elastic-agent.yml.2025-01-13T19-36-59.6439.bak
-a---- 6/11/2025 3:20 AM 735 fleet.enc
-a---- 1/13/2025 7:36 PM 0 fleet.enc.lock
-a---- 1/13/2025 7:36 PM 13675 LICENSE.txt
-a---- 1/13/2025 7:36 PM 3388637 NOTICE.txt
-a---- 1/13/2025 7:36 PM 643 otel.yml
-a---- 1/13/2025 7:36 PM 88 otelcol.ps1
-a---- 1/13/2025 7:36 PM 351 README.md
-a---- 2/28/2025 5:54 PM 0 watcher.lock

PS C:\Program Files\Elastic\Agent>

```

Also if you dig deep into that error above

```auto
	"message": "2025-06-27 22:52:48,950 WARN [0x0000306c] myapp.secevent - (112) Server connection failed secure handshake. User: . Target: . Client: 192.168.1.111:52179.",

```

I think the agent is not connecting to elasticsearch

Data is sent to Elasticsearch Typically `:9200` not the Fleet Endpoint `:8220` you may have a FW issues OR you default output for the Policy is not set up correct....

How did you set up Fleet? What does this look like on the Policy

 ![Screenshot 2025-06-27 at 5.37.55 PM](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc42bba1754e1c1c71b2127c2e5b616ea00a2685.png)  
 ![Screenshot 2025-06-27 at 5.37.19 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/1/718f66479dcc74429e80d8429d251cb5a2002aad.jpeg)

---

_[View the full topic](https://discuss.elastic.co/t/elastic-agent-8-17-7-logs-are-not-being-harvested-from-log-files-on-windows-host/379447)._