# Filebeat 1rc1 Windows does not work with Logstash 2

**URL:** https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817
**Category:** Beats
**Tags:** filebeat
**Created:** [November 17, 2015, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817 "2015-11-17T15:04:46Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Omar\_Al\_Zabir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omar_al_zabir/32/5943_2.png) [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)
#### Post date: [November 17, 2015, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817/1 "2015-11-17T15:04:46Z")

</div>

When I configure filebeat on Windows, my Logstash gives the following error:

```
{:timestamp=>"2015-11-17T14:50:30.766000+0000", :message=>"Beats input: unhandled exception", :exception=>#<RuntimeError: unsupported protocol 72>, :backtrace=>["/var/logstash-2.0.0/vendor/bundle/jruby/1.9/gems/logstash-input-beats-0.9.6/lib/lumberjack/beats/server.rb:225:in `handle_version'", "/var/logstash-2.0.0/vendor/bundle/jruby/1.9/gems/logstash-input-beats-0.9.6/lib/lumberjack/beats/server.rb:210:in `header'", "/var/logstash-2.0.0/vendor/bundle/jruby/1.9/gems/logstash-input-beats-0.9.6/lib/lumberjack/beats/server.rb:163:in `feed'", "/var/logstash-2.0.0/vendor/bundle/jruby/1.9/gems/logstash-input-beats-0.9.6/lib/lumberjack/beats/server.rb:338:in `read_socket'", "/var/logstash-2.0.0/vendor/bundle/jruby/1.9/gems/logstash-input-beats-0.9.6/lib/lumberjack/beats/server.rb:315:in `run'", "/var/logstash-2.0.0/vendor/bundle/jruby/1.9/gems/logstash-input-beats-0.9.6/lib/logstash/inputs/beats.rb:169:in `invoke'", "org/jruby/RubyProc.java:271:in `call'", "/var/logstash-2.0.0/vendor/bundle/jruby/1.9/gems/concurrent-ruby-0.9.1-java/lib/concurrent/executor/executor_service.rb:515:in `run'", "Concurrent$$JavaExecutorService$$Job_1860096801.gen:13:in `run'"], :level=>:error}

```

However, Filebeat **works on Linux**. I am using the same config file in both.

```
filebeat:
  prospectors:
    -
      paths:
       - C:\inetpub\logs\LogFiles\W3SVC14\*

      input_type: log

      fields:
        system: kanboard
        group: webserver

      fields_under_root: false

      document_type: iis

  registry_file: "C:/ProgramData/filebeat/registry"

  config_dir:

output:

  elasticsearch:

    enabled: true

    hosts: ["kibana.com:5044"]

shipper:

  tags: ["filebeat", "iis"]

```

Here's the config on Linux that works:

```
filebeat:
  prospectors:
    -
      paths:
        - /var/log/httpd/*access*

      input_type: log

      fields:
        system: kanboard
        group: webserver

      fields_under_root: true

      document_type: apache

  registry_file: .filebeat

  config_dir:

output:

  logstash:
    enabled: true

    hosts: ["kibana.com:5044"]

shipper:

  tags: ["filebeat"]
```

---

<div class="post-metadata">

### Author: ![Omar\_Al\_Zabir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omar_al_zabir/32/5943_2.png) [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)
#### Post date: [November 17, 2015, 3:32pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817/2 "2015-11-17T15:32:39Z")

</div>

sorry my bad. I had the elasticsearch configured on the filebeat yml, not logstash. We can close this issue.

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [November 17, 2015, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817/3 "2015-11-17T15:37:16Z")

</div>

Ok, glad you got it working.

---

<div class="post-metadata">

### Author: ![michaellizhou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michaellizhou/32/4143_2.png) [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)
#### Post date: [November 24, 2015, 2:14am UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817/4 "2015-11-24T02:14:17Z")

</div>

@Omar_Al_Zabir can you explain? I got the same error.

Thanks

---

<div class="post-metadata">

### Author: ![Omar\_Al\_Zabir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omar_al_zabir/32/5943_2.png) [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)
#### Post date: [December 8, 2015, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817/5 "2015-12-08T12:40:53Z")

</div>

Both logstash and elasticsearch sections were enabled. I had to comment out the elasticsearch part.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817/6 "2017-07-05T21:57:37Z")

</div>


