# Error Config send log from Windows client to ELK Server Ubuntu **URL:** \ **Category:** Logstash\ **Created:** [September 13, 2018, 8:53am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423 "2018-09-13T08:53:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![trunght2](https://avatars.discourse-cdn.com/v4/letter/t/53a042/32.png) [@trunght2](https://discuss.elastic.co/u/trunght2)\ **Post date:** [September 13, 2018, 8:53am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/1 "2018-09-13T08:53:02Z")
Hi everypeople, I setup LAB for my room. > **[Setting up a Pentesting... I mean, a Threat Hunting Lab - Part 5](https://cyberwardog.blogspot.com/2017/02/setting-up-pentesting-i-mean-threat_98.html)** > > Up to this point, this setup might look familiar. However, what I believe takes any lab set up to the next level is having a central reposit... > **[Setting up a Pentesting... I mean, a Threat Hunting Lab - Part 6](https://cyberwardog.blogspot.com/2017/02/setting-up-pentesting-i-mean-threat_87.html)** > > I wish I had an EDR vendor send me a dev agent \[hint! hint!\] to test how much event data I can capture from an endpoint, but for now I love ... I has been finished setup lab. but config send log from windows 10 to ELK Ubuntu has problem. 2018-09-13T15:44:20.359+0700 ERROR pipeline/output.go:91 Failed to connect: read tcp 172.16.99.100:50581-\>172.16.99.101:5044: wsarecv: An existing connection was forcibly closed by the remote host. 2018-09-13T15:44:46.612+0700 INFO [monitoring] log/log.go:141 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":437,"time":{"ms":16}},"total":{"ticks":1827,"time":{"ms":47},"value":1827},"user":{"ticks":1390,"time":{"ms":31}}},"info":{"ephemeral\_id":"2f4e1b0d-e296-4162-8c6e-5c9c19700b71","uptime":{"ms":390066}},"memstats":{"gc\_next":32218112,"memory\_alloc":16111120,"memory\_total":118134544,"rss":-1171456}},"libbeat":{"config":{"module":{"running":0}},"output":{"write":{"errors":1}},"pipeline":{"clients":4,"events":{"active":4120,"retry":2048}}}}}} 2018-09-13T15:45:16.614+0700 ERROR pipeline/output.go:91 Failed to connect: write tcp 172.16.99.100:50588-\>172.16.99.101:5044: wsasend: An existing connection was forcibly closed by the remote host. 2018-09-13T15:45:46.615+0700 INFO [monitoring] log/log.go:141 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":468},"total":{"ticks":1858,"value":1858},"user":{"ticks":1390}},"info":{"ephemeral\_id":"2f4e1b0d-e296-4162-8c6e-5c9c19700b71","uptime":{"ms":450069}},"memstats":{"gc\_next":32218112,"memory\_alloc":16197704,"memory\_total":118221128}},"libbeat":{"config":{"module":{"running":0}},"output":{"read":{"errors":1},"write":{"bytes":142}},"pipeline":{"clients":4,"events":{"active":4120,"retry":2048}}}}}} My config winlogbeat.yml > winlogbeat.event\_logs: > > - name: Application > ignore\_older: 72h > - name: Security > - name: System > - name: Microsoft-windows-sysmon/operational > output.logstash: > hosts: ["172.16.99.101:5044"] > ssl.certificate\_authorities: ['C:\Tools\ELK\certs\logstash-forwarder.crt'] How to fixed this proplem ? Thanks ALL !!! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 13, 2018, 9:36am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/2 "2018-09-13T09:36:50Z")
Wild guess: Winlogbeat is using SSL but Logstash isn't, or vice versa. ---
**Author:** ![trunght2](https://avatars.discourse-cdn.com/v4/letter/t/53a042/32.png) [@trunght2](https://discuss.elastic.co/u/trunght2)\ **Post date:** [September 13, 2018, 9:44am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/3 "2018-09-13T09:44:41Z")
thank you. but I do it with cyberwardog lab. If you, you can config from winlogbeat to logstash ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 13, 2018, 11:01am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/4 "2018-09-13T11:01:28Z")
I'm afraid I don't understand your question. ---
**Author:** ![trunght2](https://avatars.discourse-cdn.com/v4/letter/t/53a042/32.png) [@trunght2](https://discuss.elastic.co/u/trunght2)\ **Post date:** [September 14, 2018, 7:15am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/5 "2018-09-14T07:15:27Z")
I mean. How to config winlogbeat send event log to Logstash. with Ubuntu 18.04. ☹ ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 14, 2018, 7:40am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/6 "2018-09-14T07:40:31Z")
Did you look into the suggestion I gave earlier (SSL configuration mismatch)? Have you checked the Logstash log for clues? ---
**Author:** ![trunght2](https://avatars.discourse-cdn.com/v4/letter/t/53a042/32.png) [@trunght2](https://discuss.elastic.co/u/trunght2)\ **Post date:** [September 20, 2018, 7:38am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/7 "2018-09-20T07:38:35Z")
Thanks you. I has fixed my problem/ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 18, 2018, 7:40am UTC](https://discuss.elastic.co/t/error-config-send-log-from-windows-client-to-elk-server-ubuntu/148423/8 "2018-10-18T07:40:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.