# Error between filebeat and logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 5, 2017, 10:14am UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311 "2017-12-05T10:14:29Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![kevin.didier](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kevin.didier](https://discuss.elastic.co/u/kevin.didier)\ **Post date:** [December 5, 2017, 10:14am UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/1 "2017-12-05T10:14:29Z")
Hello, I have a problem to parse log from a windows sevrer 2012 with filebeat. The logstash is in a ubuntu server. The stack work fine beacause log from other linux server arrived correctly. I'm using ELK v6. I think it's a problem with the ssl option on windows server because when i configure the ssl option into filebeat the filebeat service return an error when I try to launch it. Coul'd someone help me ? Thanks. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 5, 2017, 1:26pm UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/2 "2017-12-05T13:26:40Z")
Can you please add filebeat configuration + logs? ---
**Author:** ![kevin.didier](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kevin.didier](https://discuss.elastic.co/u/kevin.didier)\ **Post date:** [December 5, 2017, 1:39pm UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/3 "2017-12-05T13:39:02Z")
Filebeat conf on windows server ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/0/804762264cee133e511c2bba1f6bc39da4c50660.png) What kind of log do you want ? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 5, 2017, 3:16pm UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/4 "2017-12-05T15:16:36Z")
Can you please post text instead of pictures? The filebeat logs, so we can have a look for error messages. [See log output docs](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html). Also, logstash beat input configuration. Tip: use single quotes for paths on windows. Then you don't have to deal with escaping the `\` symbol. ---
**Author:** ![kevin.didier](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kevin.didier](https://discuss.elastic.co/u/kevin.didier)\ **Post date:** [December 6, 2017, 7:04am UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/5 "2017-12-06T07:04:18Z")
This is the inpuet beats conf on logstash : input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } And this is the logon windows sever: Le service filebeat n’a pas pu démarrer en raison de l’erreur : Le service n’a pas répondu assez vite à la demande de lancement ou de contrôle. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 6, 2017, 2:06pm UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/6 "2017-12-06T14:06:23Z")
I can't find anything in the configuration. Please post filebeat logs. My french is pretty rusty, but given the windows error message I assume you installed filebeat as a service, but the service doesn't even start correctly due to timeout on startup. Run filebeat via `filebeat.exe -e -v -d '*' -c \to\filebeat.yml` in a terminal. This will run filebeat in foreground and print all logs (the -d flag enables debug logging) right to your terminal. ---
**Author:** ![kevin.didier](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kevin.didier](https://discuss.elastic.co/u/kevin.didier)\ **Post date:** [December 7, 2017, 7:46am UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/7 "2017-12-07T07:46:42Z")
Thanks for the trick, I have found the error... A mistake in the name of cert... But I have 0 log into my logstash from my windows. How I can declare my windows log into filebeat.yml ? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [December 7, 2017, 12:51pm UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/8 "2017-12-07T12:51:12Z")
Filebeat is about shipping files. For Windows Event Logs use winlogbeat. It's a special beat tailored for collecting event logs. This article gives some good details on setting up the Elastic Stack for windows event logs: [http://www.ubersec.com/2017/12/03/monitoring-for-windows-event-logs-and-the-untold-story-of-proper-elk-integration/](http://www.ubersec.com/2017/12/03/monitoring-for-windows-event-logs-and-the-untold-story-of-proper-elk-integration/) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 4, 2018, 12:51pm UTC](https://discuss.elastic.co/t/error-between-filebeat-and-logstash/110311/9 "2018-01-04T12:51:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.