Execbeats unable to run powershell

Elastic Stack Beats
1

I'm a bit stuck trying to get execbeat run a powershell and send the outcome to my elastic cluster. I'm afraid that the problem is the space that exist in windows paths (linux users must be laughing at me now)
So my configuration in execbeat is :

execbeat:
  commands:
    - command: Powershell
      args: "-Command \"$Env.Programfiles\\Execbeat\\script.ps1\""

The std out is actually the path and it doesn't execute the script
it shows like this:
exec.stdout: "C:\\Program Files\\Execbeat\\script.ps1"

If Program Files didn't have a space in it. it would work fine as I tested:

args: "-Command C:\\Execbeat\\script.ps1"

But unfortunately I can't deploy in the root.
I also tried to escape the space with \ , with ^ even with the back tick ` before the space but nothing seems to work
any ideas?

2

Looks like using the back tick but without the -Command works:

args: "C:\\Program` Files\Execbeat\\script.ps1"
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.