Filebeat in windows 2008 r2 - not sending data to logstash


I installed filebeat 1.0.1 in my windows 2008 r2 server. I have configured the below path and logstash server output

    - C:\Documentum\dba\*.log

# The Logstash hosts
hosts: [""]

Port 5044 is open in my logstash server and one of my linux client where I have installed filebeat is behaving well and sending data to the same logstash server. I also checked to make sure there are no unwanted tab space in the yml file.

This is the output that I get when running filebeat in -v mode.

PS C:\Program Files\Filebeat> .\filebeat.exe -c filebeat.yml -e -v
2016/01/22 12:41:15.359008 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths
2016/01/22 12:41:15.361938 outputs.go:111: INFO Activated logstash as output plugin.
2016/01/22 12:41:15.362915 publish.go:249: INFO Publisher name: ARM-RD-W8X-D671
2016/01/22 12:41:15.367799 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1
2016/01/22 12:41:15.369753 beat.go:133: INFO filebeat sucessfully setup. Start running.
2016/01/22 12:41:15.370730 registrar.go:66: INFO Registry file set to: C:\ProgramData\filebeat\registry
2016/01/22 12:41:15.371706 registrar.go:76: INFO Loading registrar data from C:\ProgramData\filebeat\registry
2016/01/22 12:41:15.372683 spooler.go:77: INFO Starting spooler: spool_size: 1024; idle_timeout: 5s
2016/01/22 12:41:15.373660 crawler.go:78: INFO All prospectors initialised with 0 states to persist
2016/01/22 12:41:15.373660 registrar.go:83: INFO Starting Registrar
2016/01/22 12:41:15.374637 filebeat.go:122: INFO Start sending events to output

Filebeat log files are also not generated. Could you please let me know what could be wrong?


Sorry, it was my mistake. filebeat was running fine. But the path was wrong, so I did not see expected communication between the filebeat host and logstash server.

But I still dont know why I am not seeing filebeat log files in C:\ProgramData\filebeat\Logs

Filebeat log files are also not generated. Could you please let me know what could be wrong?

What does your Filebeat command line look like?

.\filebeat.exe -c filebeat.yml -e -v -d "*"

I tried this and filebeat is sending data to my logstash server. The logs are not created even when I start filebeat from services.

That indicates that your filebeat.yml doesn't configure logging properly. See for details.