# Execbeats unable to run powershell

**URL:** <https://discuss.elastic.co/t/execbeats-unable-to-run-powershell/344160>\
**Category:** Beats\
**Tags:** functionbeat\
**Created:** [September 29, 2023, 8:02pm UTC](https://discuss.elastic.co/t/execbeats-unable-to-run-powershell/344160 "2023-09-29T20:02:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![A\_Mightiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_mightiev/32/62186_2.png) [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\
**Post date:** [September 29, 2023, 8:02pm UTC](https://discuss.elastic.co/t/execbeats-unable-to-run-powershell/344160/1 "2023-09-29T20:02:16Z")

</div>

I'm a bit stuck trying to get execbeat run a powershell and send the outcome to my elastic cluster. I'm afraid that the problem is the space that exist in windows paths (linux users must be laughing at me now)  
So my configuration in execbeat is :

```auto
execbeat:
  commands:
    - command: Powershell
      args: "-Command \"$Env.Programfiles\\Execbeat\\script.ps1\""

```

The std out is actually the path and it doesn't execute the script  
it shows like this:  
`exec.stdout: "C:\\Program Files\\Execbeat\\script.ps1"`

If Program Files didn't have a space in it. it would work fine as I tested:

```auto
args: "-Command C:\\Execbeat\\script.ps1" 

```

But unfortunately I can't deploy in the root.  
I also tried to escape the space with `\ ` , with `^ ` even with the back tick ` before the space but nothing seems to work  
any ideas?

---

<div class="post-metadata">

**Author:** ![A\_Mightiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_mightiev/32/62186_2.png) [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\
**Post date:** [September 30, 2023, 12:20pm UTC](https://discuss.elastic.co/t/execbeats-unable-to-run-powershell/344160/2 "2023-09-30T12:20:50Z")

</div>

Looks like using the back tick but without the `-Command` works:

```auto
args: "C:\\Program` Files\Execbeat\\script.ps1"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2023, 2:21pm UTC](https://discuss.elastic.co/t/execbeats-unable-to-run-powershell/344160/3 "2023-10-28T14:21:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.