# Filebeat getting sent to syswow64 instead of system32 \[1.2.3\]

**URL:** <https://discuss.elastic.co/t/filebeat-getting-sent-to-syswow64-instead-of-system32-1-2-3/54323>\
**Category:** Beats\
**Created:** [June 29, 2016, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-getting-sent-to-syswow64-instead-of-system32-1-2-3/54323 "2016-06-29T17:41:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arizonawayfarer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arizonawayfarer/32/44846_2.png) [@arizonawayfarer](https://discuss.elastic.co/u/arizonawayfarer)\
**Post date:** [June 29, 2016, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-getting-sent-to-syswow64-instead-of-system32-1-2-3/54323/1 "2016-06-29T17:41:46Z")

</div>

So, I've been trying to get filebeat to harvest DHCP logs in the system32 folder on windows. After making sure permissions and everything weren't the issue, I decided to run procmon to see what was holding it up.

Turns out that when filebeat tries to go to c:\windows\system32\dhcp it's actually getting sent to c:\windows\syswow64\dhcp which doesn't exist, and also kinda weird, but that's Microsoft for you.

Anywho, this is happening because filebeat is offered as an x86 binary (I checked the PE headers). Is there any way to get an x64 version of filebeat so that Windows doesn't direct requests to syswow64?

EDIT: For posterity, you can work around this by going to c:\windows\sysnative instead of c:\windows\system32

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [June 30, 2016, 5:52am UTC](https://discuss.elastic.co/t/filebeat-getting-sent-to-syswow64-instead-of-system32-1-2-3/54323/2 "2016-06-30T05:52:50Z")

</div>

Starting with 5.0, we are offering 32 and 64-bit downloads for Windows. The alpha version is available on the [download pages](https://www.elastic.co/downloads/beats/filebeat) now. If you want a 64-bit version of Filebeat 1.X for Windows you'll have to `go build` it yourself.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2016, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-getting-sent-to-syswow64-instead-of-system32-1-2-3/54323/3 "2016-07-20T17:41:53Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.