Filebeat windows service not starting

Elastic Stack Beats
1

Hi,

I can run filebeat on foreground and send logs to logstash (both version 6.3). However, it wouldn't start as a windows service. Logstash successfully runs as a windows service.

If I use 'Start-Service' command for filebeat in powershell, I get the below:

    Start-Service : Service 'filebeat (filebeat)' cannot be started due to the following error: Cannot start service filebeat on computer '.'.
    At line:1 char:1
    + Start-Service -Name "filebeat"
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
        + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

The windows service is run under LocalSystem account (same as logstash windows service). When starting the service manually, I get Error: 1053, the service did not respond to the start or control request in a timely fashion. I have hit the same problem on 3 different machines that I have now tried (2 windows server 2012 R2 and 1 windows 10).

Appreciate any input to investigate this further.

Thanks.

2

Can you check the filebeat logs?

3

The logs folder under filebeat is empty. Is there another location where it will be written?

4

Can you try to start filebeat from console with debug enabled:

filebeat.exe -e -v -d "*" -c <path/to/config/file>
5

Filebeat runs fine from console window. I have tried what you suggested and still can't see any logs within filebeat. Below is my logging configuration in filebeat.yml

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
logging.level: debug
logging.to_syslog: false
logging.to_files: true
logging.files:
  path: C:\Audit\filebeat\logs
  name: filebeat
  keepfiles: 7
  permissions: 0644

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["*"]

Is there anything wrong with this especially the path? Filebeat won't start as a windows service.

6

Does the service start with the same user?

Have you checked windows event logs?

7

I have redone the whole setup again on a clean machine and the filebeat service started successfully. However, it doesn't seem to send anything to logstash. If I run filebeat from console using the below, logs are pushed to logstash correctly.

C:\Audit\filebeat\filebeat.exe -e -c "C:\Audit\filebeat\filebeat.yml" -d "publish"

Below are the settings that I see in my filebeat service properties. Are these correct?

"C:\Audit\Filebeat\filebeat.exe" -c "C:\Audit\Filebeat\filebeat.yml" -path.home "C:\Audit\Filebeat" -path.data "C:\ProgramData\filebeat" -path.logs "C:\ProgramData\filebeat\logs"

I'm using windows and filebeat package is unzipped into c:\audit. What else could be wrong when using filebeat as a windows service?

Thanks for the support.

8

It is booting issue of your system. You can also check compiled under a hidden window. Here you start or stop window. If you are facing any window error then check error 0x8024200b it for remove error code

9

Don't think it has to do with any booting issue. Has anyone got the filebeat windows service working correctly?

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.