# ELK on Windows Server 2016 with Filebeat on Windows 10 client - not working **URL:** \ **Category:** Elasticsearch\ **Created:** [November 27, 2019, 10:30am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659 "2019-11-27T10:30:16Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![JY\_DT](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Post date:** [November 27, 2019, 10:30am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/1 "2019-11-27T10:30:16Z")
Hello, I've setup ELK 7.4.2 on Windows Server 2016, with some of these references: > **[Demystifying ELK stack](https://cezarypiatek.github.io/post/demystifying-elk-stack/)** > > How to easily implement centralized logging system based on ELK stack. [http://robwillis.info/2019/05/installing-elk-7-elasticsearch-logstash-and-kibana-windows-server-2016/](http://robwillis.info/2019/05/installing-elk-7-elasticsearch-logstash-and-kibana-windows-server-2016/) > **[Installing the ELK Stack on Windows | Logz.io](https://logz.io/blog/installing-the-elk-stack-on-windows/)** > > This tutorial provides a step-by-step guide to installing the ELK Stack (Elasticsearch, Logstash and Kibana) as services on Windows Server 2012. and I've setup Filebeat on my Windows 10 client machine. It looks like all the installations are fine, and I'm able to start all services. But no data seems to be inserted into Elasticsearch. I'm not sure what's going wrong. On the server machine: 1. When I enter this in a browser: [http://localhost:9200/](http://localhost:9200/) I see the details correctly. 1. And on this: [http://localhost:9200/\_cat/indices](http://localhost:9200/_cat/indices) I see these indexes: green open .kibana\_task\_manager\_1 MNLTzyjNQk2\_DBwLbLAUjQ 1 0 2 0 13.3kb 13.3kb green open kibana\_sample\_data\_ecommerce MD4yCUShR4KJi0qzrWo1lQ 1 0 4675 0 4.4mb 4.4mb green open .apm-agent-configuration bqpM6GzVS7mJJNtxbWrVvg 1 0 0 0 283b 283b green open .kibana\_1 9S6hqlJnS2KxsKPYh1viyw 1 0 74 7 954.3kb 954.3kb 1. On viewing Kibana, in the browser: [http://127.0.0.1:5601/](http://127.0.0.1:5601/) and then selecting "Index Patterns", I see only kibana\_sample\_data\_ecommerce and I don't see anything related to filebeat\* On the Client machine: 1. Filebeat is installed and configured correctly. I've enabled logstash output with the correct IP and port address. What could be wrong? I should be able to see the indices getting created and then be able to query for data. Thanks, Jy ---
**Author:** ![MiTschMR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mitschmr/32/48254_2.png) [@MiTschMR](https://discuss.elastic.co/u/MiTschMR)\ **Post date:** [November 27, 2019, 10:34am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/2 "2019-11-27T10:34:22Z")
Hi @JY_DT Please share your configuration for Filebeat and Logstash with us. Without them it is more of a quiz. Cheers MiTschMR ---
**Author:** ![JY\_DT](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Post date:** [November 27, 2019, 10:40am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/3 "2019-11-27T10:40:07Z")
Sure, is there a way to upload a file. But anyway, here are the configs: 1. Filebeat: ''' filebeat.inputs: - type: log enabled: true paths: - C:\ProgramData\DiagramOne\STool\Trace\* output.logstash: hosts: ["MyserverIP:5044"] bulk\_max\_size: 1024 ''' These are the only things I've changed. ---
**Author:** ![JY\_DT](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Post date:** [November 27, 2019, 10:41am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/4 "2019-11-27T10:41:33Z")
And for Logstash on the Server: The logstash.conf file contains: ''' input { beats { port =\> 5044 type =\> "log" } } output { elasticsearch { hosts =\> "[http://localhost:9200](http://localhost:9200)" sniffing =\> true manage\_template =\> false index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } } ''' ---
**Author:** ![MiTschMR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mitschmr/32/48254_2.png) [@MiTschMR](https://discuss.elastic.co/u/MiTschMR)\ **Post date:** [November 27, 2019, 10:45am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/5 "2019-11-27T10:45:51Z")
Hi @JY_DT Please format your code and check it in the preview window. It can be hard to read and people might skip your post. Use triple-backsticks ``` above and below the text. It should then look like this: ```auto Formatted text ``` Thank you very much. ---
**Author:** ![MiTschMR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mitschmr/32/48254_2.png) [@MiTschMR](https://discuss.elastic.co/u/MiTschMR)\ **Post date:** [November 27, 2019, 10:49am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/6 "2019-11-27T10:49:01Z")
Please post the content of your filebeat log file. You can find the file under C:\ProgramData\filebeat\logs. ---
**Author:** ![JY\_DT](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Post date:** [November 27, 2019, 10:54am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/7 "2019-11-27T10:54:32Z")
''' | 2019-11-26T18:40:43.330+0530 | INFO | instance/beat.go:607 | Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs] | | --- | --- | --- | --- | | 2019-11-26T18:40:43.335+0530 | INFO | instance/beat.go:615 | Beat ID: 6487577c-a9c3-4918-8bdb-520ff8aa9a53 | ''' ---
**Author:** ![MiTschMR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mitschmr/32/48254_2.png) [@MiTschMR](https://discuss.elastic.co/u/MiTschMR)\ **Post date:** [November 27, 2019, 4:03pm UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/8 "2019-11-27T16:03:39Z")
Hi @JY_DT As you can see in the filebeat log file, the path for the logs is not C:\ProgramData\filebeat, it is C:\Program Files\Filebeat\logs. Please share the content of the log file from there. ---
**Author:** ![JY\_DT](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Post date:** [November 28, 2019, 10:25am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/9 "2019-11-28T10:25:40Z")
Hi, I'm actually trying this now: Load the index template in Elasticsearch: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html) and I get these errors in the log file. ''' 2019-11-28T15:44:23.248+0530 INFO [publisher] pipeline/module.go:97 Beat name: Something 2019-11-28T15:44:23.250+0530 INFO elasticsearch/client.go:170 Elasticsearch url: [http://192.168.103.84:9200](http://192.168.103.84:9200) 2019-11-28T15:44:25.269+0530 ERROR elasticsearch/elasticsearch.go:260 Error connecting to Elasticsearch at [http://192.168.103.84:9200](http://192.168.103.84:9200): Get [http://192.168.103.84:9200](http://192.168.103.84:9200): dial tcp 192.168.103.84:9200: connectex: No connection could be made because the target machine actively refused it. 2019-11-28T15:44:25.269+0530 ERROR instance/beat.go:878 Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: [Error connection to Elasticsearch [http://192.168.103.84:9200](http://192.168.103.84:9200): Get [http://192.168.103.84:9200](http://192.168.103.84:9200): dial tcp 192.168.103.84:9200: connectex: No connection could be made because the target machine actively refused it.] ''' ---
**Author:** ![JY\_DT](https://avatars.discourse-cdn.com/v4/letter/j/5e9695/32.png) [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Post date:** [November 28, 2019, 10:29am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/10 "2019-11-28T10:29:14Z")
Please note that on the m/c where ELK is installed has the firewall disabled, and I've also added firewall rules to allow incoming to ELK. So, I'm not sure why this error occurs. Also, I'm able to ping the ELK m/c from my client m/c. Thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 26, 2019, 10:29am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659/11 "2019-12-26T10:29:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.