# Filebeat service won't run on windows 2016 & 2012r2 EC2 instance

**URL:** <https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 26, 2018, 6:37pm UTC](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075 "2018-08-26T18:37:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![maffydavison](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@maffydavison](https://discuss.elastic.co/u/maffydavison)\
**Post date:** [August 26, 2018, 6:37pm UTC](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075/1 "2018-08-26T18:37:18Z")

</div>

Configured my windows instance with the instance metadata.  
Used the install-service-filebeat.ps1 to install the service.  
The result is:

PS C:\Filebeat\> C:\Filebeat\install-service-filebeat.ps1

\_\_GENUS : 2  
\_\_CLASS : \_\_PARAMETERS  
\_\_SUPERCLASS :  
\_\_DYNASTY : \_\_PARAMETERS  
\_\_RELPATH :  
\_\_PROPERTY\_COUNT : 1  
\_\_DERIVATION : {}  
\_\_SERVER :  
\_\_NAMESPACE :  
\_\_PATH :  
ReturnValue : 5  
PSComputerName :

\_\_GENUS : 2  
\_\_CLASS : \_\_PARAMETERS  
\_\_SUPERCLASS :  
\_\_DYNASTY : \_\_PARAMETERS  
\_\_RELPATH :  
\_\_PROPERTY\_COUNT : 1  
\_\_DERIVATION : {}  
\_\_SERVER :  
\_\_NAMESPACE :  
\_\_PATH :  
ReturnValue : 0  
PSComputerName :

C:\Filebeat  
Status : Stopped  
Name : filebeat  
DisplayName : filebeat

Since I am using SSM to automate the process of bringing up and testing these instances, I need to know how to get from install, which doesn't complain, but also doesn't bring up the service, to something that will install and start the filebeat service.

Any ideas? Used

---

<div class="post-metadata">

**Author:** ![maffydavison](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@maffydavison](https://discuss.elastic.co/u/maffydavison)\
**Post date:** [August 26, 2018, 7:13pm UTC](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075/2 "2018-08-26T19:13:16Z")

</div>

In case anyone is running into the same problem, it was a problem with the configuration file.  
Our linux instances use [] chars around the hosts list, and windows doesn't like that.  
'unknown escape character' is what it complained about.

This issue can be closed. automation is working now.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 27, 2018, 12:44am UTC](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075/3 "2018-08-27T00:44:51Z")

</div>

Would you be able to open an issue on GitHub so we can look at this further, perhaps there's something we can do in the code to factor this in?

> **[Build software better, together](https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Felastic%2Fbeats%2Fissues%2Fnew)**
>
> GitHub is where people build software. More than 28 million people use GitHub to discover, fork, and contribute to over 85 million projects.

---

<div class="post-metadata">

**Author:** ![maffydavison](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@maffydavison](https://discuss.elastic.co/u/maffydavison)\
**Post date:** [August 27, 2018, 1:06am UTC](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075/4 "2018-08-27T01:06:28Z")

</div>

There is no need. It didn't start on boot because characters that are fine in the linux config caused windows to fail. Once I fixed the config file, then filebeat came up just fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2018, 1:06am UTC](https://discuss.elastic.co/t/filebeat-service-wont-run-on-windows-2016-2012r2-ec2-instance/146075/5 "2018-09-24T01:06:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.