# Filebeat on Windows seem to not use the registry file **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 23, 2017, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241 "2017-02-23T14:47:33Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Steiniche](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Steiniche](https://discuss.elastic.co/u/Steiniche)\ **Post date:** [February 23, 2017, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/1 "2017-02-23T14:47:33Z")
Hello, We have just migrated to Elastic Stack 5.2. Filebeat version 5.2.1 We have filebeats running on Windows Server 2012 R2 and every time the filebeat service is restart all lines from all harvested logs gets send again. The registry file is updated (Can be seen from the modification time of the file). We have furthermore tried to close filebeat, delete the registry file, start filebeat which results in a new registry file being created which seems to be valid. However, when the service is restarted after the new registry file is created all log lines gets send once more. Filebeat configuration: [https://gist.github.com/Steiniche/d2c62c6aaac71d989039346340412203](https://gist.github.com/Steiniche/d2c62c6aaac71d989039346340412203) Registry file from a server: [https://gist.github.com/Steiniche/5893b3b5ad8d6e5fb63f2004a3679129](https://gist.github.com/Steiniche/5893b3b5ad8d6e5fb63f2004a3679129) ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [February 24, 2017, 12:23pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/2 "2017-02-24T12:23:16Z")
All the config options and the registry file seem to be as expected. Can you share some log output from filebeat, best in debug level? Especially the first 200 lines when starting filebeat again with an existing registry file would be interesting. As the lines will not fit in the forum, best post them into a gist and link it here. ---
**Author:** ![Steiniche](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Steiniche](https://discuss.elastic.co/u/Steiniche)\ **Post date:** [March 2, 2017, 7:20am UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/3 "2017-03-02T07:20:37Z")
Hi @ruflin thanks for helping out! Turning on the debug log quickly produced many 1MB log files which contains mostly publish events - this confirms my suspicion that everything gets send again. I have taken the first ~100 lines and posted here: [https://gist.github.com/Steiniche/029069e134aa232f8cee30142b98f4ef](https://gist.github.com/Steiniche/029069e134aa232f8cee30142b98f4ef) However, I have only included the first Publish event. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 3, 2017, 12:33pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/4 "2017-03-03T12:33:57Z")
Thanks for the logs. It seems that filebeat first finds the states in the registry: `States Loaded from registrar: 21` but then fails to match the files to the prospectors and prospectors are started without states. I remember we had an issue about path matching in the 5.0-beta versions but this should have been fixed. I'm curious if this is a similar issue again that it does not match `C:/logs/a/server.log` and `C:\/logs\/a\/server.log` from the registry file. From which version of filebeat were you migrating? ---
**Author:** ![Steiniche](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Steiniche](https://discuss.elastic.co/u/Steiniche)\ **Post date:** [March 3, 2017, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/5 "2017-03-03T16:02:20Z")
No problem. We upgraded from 1.3.1 to 5.2.1 ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 3, 2017, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/6 "2017-03-03T16:14:11Z")
Can you check if the problem persist in case you start with an empty registry file in 5.2.1, stop filebeat and start filebeat again? ---
**Author:** ![Steiniche](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Steiniche](https://discuss.elastic.co/u/Steiniche)\ **Post date:** [March 7, 2017, 9:00am UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/7 "2017-03-07T09:00:10Z")
I have now tried deleting the old registry files and restarted filebeat a couple of times. It does however not work and events still get resend. Anymore ideas? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 11, 2017, 3:51pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/8 "2017-03-11T15:51:50Z")
That is really strange ☹ Could you share again the log file and registry from 5.2.1 (same as above) so I can have a look again, now without the migration. ---
**Author:** ![Steiniche](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Steiniche](https://discuss.elastic.co/u/Steiniche)\ **Post date:** [March 13, 2017, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/9 "2017-03-13T13:11:12Z")
I agree with you @ruflin it is pretty strange. 1st startup with clean registry: [https://gist.github.com/Steiniche/eda6d15b035efc578587d6df036e5546](https://gist.github.com/Steiniche/eda6d15b035efc578587d6df036e5546) 2nd startup using registry from 1st startup: [https://gist.github.com/Steiniche/eb2d8fffd10080b72b41a3c419f00df0](https://gist.github.com/Steiniche/eb2d8fffd10080b72b41a3c419f00df0) ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 15, 2017, 9:17pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/10 "2017-03-15T21:17:53Z")
I really need to do some testing for this on a Windows machine and try to reproduce it. I'm probably only going to be able to do this next week. The part that bugs me: In case it is a "general" bug it would affect a lot of user and I would hope it would have popped up much earlier. At the same time, users don't restart filebeat often. Will definitively dig deeper into this one. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 16, 2017, 3:39pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/11 "2017-03-16T15:39:36Z")
@ruflin Another similar issue: [Duplicate events with Filebeat on windows on service restart](https://discuss.elastic.co/t/duplicate-events-with-filebeat-on-windows-on-service-restart/78743/1) ---
**Author:** ![eirc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eirc/32/11769_2.png) [@eirc](https://discuss.elastic.co/u/eirc)\ **Post date:** [March 16, 2017, 5:23pm UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/12 "2017-03-16T17:23:17Z")
Yeah this looks like it's exactly the same issue, should I close my thread? I'll be back on Monday to do that though 🙂 ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 20, 2017, 8:52am UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/13 "2017-03-20T08:52:39Z")
No need to close the thread as both have additional infos inside. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 17, 2017, 8:52am UTC](https://discuss.elastic.co/t/filebeat-on-windows-seem-to-not-use-the-registry-file/76241/14 "2017-04-17T08:52:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.