# Filebeat windows service not starting **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 15, 2018, 10:56am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475 "2018-10-15T10:56:21Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![sthambir](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@sthambir](https://discuss.elastic.co/u/sthambir)\ **Post date:** [October 15, 2018, 10:56am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/1 "2018-10-15T10:56:21Z")
Hi, I can run filebeat on foreground and send logs to logstash (both version 6.3). However, it wouldn't start as a windows service. Logstash successfully runs as a windows service. If I use 'Start-Service' command for filebeat in powershell, I get the below: ``` Start-Service : Service 'filebeat (filebeat)' cannot be started due to the following error: Cannot start service filebeat on computer '.'. At line:1 char:1 + Start-Service -Name "filebeat" + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand ``` The windows service is run under LocalSystem account (same as logstash windows service). When starting the service manually, I get Error: 1053, the service did not respond to the start or control request in a timely fashion. I have hit the same problem on 3 different machines that I have now tried (2 windows server 2012 R2 and 1 windows 10). Appreciate any input to investigate this further. Thanks. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 17, 2018, 11:38am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/2 "2018-10-17T11:38:06Z")
Can you check the filebeat logs? ---
**Author:** ![sthambir](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@sthambir](https://discuss.elastic.co/u/sthambir)\ **Post date:** [October 18, 2018, 10:47am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/3 "2018-10-18T10:47:53Z")
The logs folder under filebeat is empty. Is there another location where it will be written? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 18, 2018, 10:09pm UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/4 "2018-10-18T22:09:31Z")
Can you try to start filebeat from console with debug enabled: ```auto filebeat.exe -e -v -d "*" -c ``` ---
**Author:** ![sthambir](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@sthambir](https://discuss.elastic.co/u/sthambir)\ **Post date:** [October 23, 2018, 9:19am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/5 "2018-10-23T09:19:40Z")
Filebeat runs fine from console window. I have tried what you suggested and still can't see any logs within filebeat. Below is my logging configuration in filebeat.yml ``` #================================ Logging ===================================== # Sets log level. The default log level is info. # Available log levels are: critical, error, warning, info, debug logging.level: debug logging.to_syslog: false logging.to_files: true logging.files: path: C:\Audit\filebeat\logs name: filebeat keepfiles: 7 permissions: 0644 # At debug level, you can selectively enable logging only for some components. # To enable all selectors use ["*"]. Examples of other selectors are "beat", # "publish", "service". logging.selectors: ["*"] ``` Is there anything wrong with this especially the path? Filebeat won't start as a windows service. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [October 23, 2018, 11:02am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/6 "2018-10-23T11:02:29Z")
Does the service start with the same user? Have you checked windows event logs? ---
**Author:** ![sthambir](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@sthambir](https://discuss.elastic.co/u/sthambir)\ **Post date:** [October 23, 2018, 3:23pm UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/7 "2018-10-23T15:23:18Z")
I have redone the whole setup again on a clean machine and the filebeat service started successfully. However, it doesn't seem to send anything to logstash. If I run filebeat from console using the below, logs are pushed to logstash correctly. `C:\Audit\filebeat\filebeat.exe -e -c "C:\Audit\filebeat\filebeat.yml" -d "publish"` Below are the settings that I see in my filebeat service properties. Are these correct? `"C:\Audit\Filebeat\filebeat.exe" -c "C:\Audit\Filebeat\filebeat.yml" -path.home "C:\Audit\Filebeat" -path.data "C:\ProgramData\filebeat" -path.logs "C:\ProgramData\filebeat\logs"` I'm using windows and filebeat package is unzipped into c:\audit. What else could be wrong when using filebeat as a windows service? Thanks for the support. ---
**Author:** ![CassieGriffin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cassiegriffin/32/36847_2.png) [@CassieGriffin](https://discuss.elastic.co/u/CassieGriffin)\ **Post date:** [October 23, 2018, 6:35pm UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/8 "2018-10-23T18:35:46Z")
It is booting issue of your system. You can also check compiled under a hidden window. Here you start or stop window. If you are facing any window error then check [error 0x8024200b](https://babasupport.org/windows/windows-error-0x8024200b/) it for remove error code ---
**Author:** ![sthambir](https://avatars.discourse-cdn.com/v4/letter/s/35a633/32.png) [@sthambir](https://discuss.elastic.co/u/sthambir)\ **Post date:** [October 24, 2018, 10:53am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/9 "2018-10-24T10:53:43Z")
Don't think it has to do with any booting issue. Has anyone got the filebeat windows service working correctly? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 21, 2018, 11:07am UTC](https://discuss.elastic.co/t/filebeat-windows-service-not-starting/152475/10 "2018-11-21T11:07:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.