Filebeat windows service not starting

(sthambir) #1


I can run filebeat on foreground and send logs to logstash (both version 6.3). However, it wouldn't start as a windows service. Logstash successfully runs as a windows service.

If I use 'Start-Service' command for filebeat in powershell, I get the below:

    Start-Service : Service 'filebeat (filebeat)' cannot be started due to the following error: Cannot start service filebeat on computer '.'.
    At line:1 char:1
    + Start-Service -Name "filebeat"
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
        + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

The windows service is run under LocalSystem account (same as logstash windows service). When starting the service manually, I get Error: 1053, the service did not respond to the start or control request in a timely fashion. I have hit the same problem on 3 different machines that I have now tried (2 windows server 2012 R2 and 1 windows 10).

Appreciate any input to investigate this further.


(Steffen Siering) #2

Can you check the filebeat logs?

(sthambir) #3

The logs folder under filebeat is empty. Is there another location where it will be written?

(Steffen Siering) #4

Can you try to start filebeat from console with debug enabled:

filebeat.exe -e -v -d "*" -c <path/to/config/file>

(sthambir) #5

Filebeat runs fine from console window. I have tried what you suggested and still can't see any logs within filebeat. Below is my logging configuration in filebeat.yml

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
logging.level: debug
logging.to_syslog: false
logging.to_files: true
  path: C:\Audit\filebeat\logs
  name: filebeat
  keepfiles: 7
  permissions: 0644

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["*"]

Is there anything wrong with this especially the path? Filebeat won't start as a windows service.

(Steffen Siering) #6

Does the service start with the same user?

Have you checked windows event logs?

(sthambir) #7

I have redone the whole setup again on a clean machine and the filebeat service started successfully. However, it doesn't seem to send anything to logstash. If I run filebeat from console using the below, logs are pushed to logstash correctly.

C:\Audit\filebeat\filebeat.exe -e -c "C:\Audit\filebeat\filebeat.yml" -d "publish"

Below are the settings that I see in my filebeat service properties. Are these correct?

"C:\Audit\Filebeat\filebeat.exe" -c "C:\Audit\Filebeat\filebeat.yml" -path.home "C:\Audit\Filebeat" "C:\ProgramData\filebeat" -path.logs "C:\ProgramData\filebeat\logs"

I'm using windows and filebeat package is unzipped into c:\audit. What else could be wrong when using filebeat as a windows service?

Thanks for the support.

(Cassie Griffin) #8

It is booting issue of your system. You can also check compiled under a hidden window. Here you start or stop window. If you are facing any window error then check error 0x8024200b it for remove error code

(sthambir) #9

Don't think it has to do with any booting issue. Has anyone got the filebeat windows service working correctly?

(system) #10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.