# Harvester doesn't start when filebeat started as windows service **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 9, 2020, 10:29am UTC](https://discuss.elastic.co/t/harvester-doesnt-start-when-filebeat-started-as-windows-service/222683 "2020-03-09T10:29:45Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Gauthier\_Le\_Moulec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gauthier_le_moulec/32/60614_2.png) [@Gauthier\_Le\_Moulec](https://discuss.elastic.co/u/Gauthier_Le_Moulec)\ **Post date:** [March 9, 2020, 10:29am UTC](https://discuss.elastic.co/t/harvester-doesnt-start-when-filebeat-started-as-windows-service/222683/1 "2020-03-09T10:29:45Z")
Hey, I'm using filebeat to connect to Logstash... (and I work on windows 10) I have no problem running filebeat from the shell launching the single command "filebeat -e" but when I try to launch it as a windows service it doesn't work... This is my filebeat.yml config file: ``` ###################### Filebeat Configuration Example ######################### # This file is an example configuration file highlighting only the most common # options. The filebeat.reference.yml file from the same directory contains all the # supported options with more comments. You can use it as a reference. # # You can find the full configuration reference here: # https://www.elastic.co/guide/en/beats/filebeat/index.html # For more available modules and options, please see the filebeat.reference.yml sample # configuration file. #=========================== Filebeat inputs ============================= filebeat.inputs: # Each - is an input. Most options can be set at the input level, so # you can use different inputs for various configurations. # Below are the input specific configurations. - type: log # Change to true to enable this input configuration. enabled: true # Paths that should be crawled and fetched. Glob based paths. # USER ACTION path server: modify path with variable LOGS-SERVER paths: #- /var/log/*.log #- \\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\core\current\VDORYSIFME1_fmescheduler.log #- \\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\engine\current\jobs\10000\*.log - \\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\core\current\VDORYSIFME1_fmeserver.log #- c:\programdata\elasticsearch\logs\* #close_eof: true # Exclude lines. A list of regular expressions to match. It drops the lines that are # matching any regular expression from the list. #exclude_lines: ['^DBG'] # Include lines. A list of regular expressions to match. It exports the lines that are # matching any regular expression from the list. #include_lines: ['^ERR', '^WARN'] # Exclude files. A list of regular expressions to match. Filebeat drops the files that # are matching any regular expression from the list. By default, no files are dropped. #exclude_files: ['.gz$'] # Optional additional fields. These fields can be freely picked # to add additional information to the crawled log files for filtering #fields: # level: debug # review: 1 fields: {log_type: server} ### Multiline options # Multiline can be used for log messages spanning multiple lines. This is common # for Java Stack Traces or C-Line Continuation # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ #multiline.pattern: ^\[ # Defines if the pattern set under pattern should be negated or not. Default is false. #multiline.negate: false # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern # that was (not) matched before or after or as long as a pattern is not matched based on negate. # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash #multiline.match: after - type: log enabled: true # USER ACTION path scheduler: modify path with variable LOGS-SCHEDULER paths: - \\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\core\current\VDORYSIFME1_fmescheduler.log fields: {log_type: scheduler} - type: log enabled: true # USER ACTION path engines: modify path with variable LOGS-ENGINES paths: - \\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\engine\current\jobs\*\*.log fields: {log_type: engine} #============================= Filebeat modules =============================== filebeat.config.modules: # Glob pattern for configuration loading path: ${path.config}/modules.d/*.yml # Set to true to enable config reloading reload.enabled: true # Period on which files under path should be checked for changes #reload.period: 10s #==================== Elasticsearch template setting ========================== setup.template.settings: index.number_of_shards: 1 #index.codec: best_compression #_source.enabled: false #================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. #name: # The tags of the shipper are included in their own field with each # transaction published. #tags: ["service-X", "web-tier"] # Optional fields that you can specify to add additional information to the # output. #fields: # env: staging #============================== Dashboards ===================================== # These settings control loading the sample dashboards to the Kibana index. Loading # the dashboards is disabled by default and can be enabled either by setting the # options here or by using the `setup` command. #setup.dashboards.enabled: false # The URL from where to download the dashboards archive. By default this URL # has a value which is computed based on the Beat name and version. For released # versions, this URL points to the dashboard archive on the artifacts.elastic.co # website. #setup.dashboards.url: #============================== Kibana ===================================== # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API. # This requires a Kibana endpoint configuration. #setup.kibana: # Kibana Host # Scheme and port can be left out and will be set to the default (http and 5601) # In case you specify and additional path, the scheme is required: http://localhost:5601/path # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601 # host: "22.1.68.129:5601" # Kibana Space ID # ID of the Kibana Space into which the dashboards should be loaded. By default, # the Default Space will be used. #space.id: #============================= Elastic Cloud ================================== # These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/). # The cloud.id setting overwrites the `output.elasticsearch.hosts` and # `setup.kibana.host` options. # You can find the `cloud.id` in the Elastic Cloud web UI. #cloud.id: # The cloud.auth setting overwrites the `output.elasticsearch.username` and # `output.elasticsearch.password` settings. The format is `:`. #cloud.auth: #================================ Outputs ===================================== # Configure what output to use when sending the data collected by the beat. #-------------------------- Elasticsearch output ------------------------------ #output.elasticsearch: # Array of hosts to connect to. # hosts: ["localhost:9200"] # Optional protocol and basic auth credentials. #protocol: "https" #username: "elastic" #password: "changeme" #----------------------------- Logstash output -------------------------------- output.logstash: # The Logstash hosts hosts: ["localhost:5044"] timeout: 1200 bulk_max_size: 5 # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate_authorities: ["E:/ELK/certificates/certif-ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "E:/ELK/certificates/certif-ca.pem" # Client Certificate Key #ssl.key: "elastic-dev-ca" #================================ Processors ===================================== # Configure processors to enhance or manipulate events generated by the beat. processors: - add_host_metadata: ~ - add_cloud_metadata: ~ - add_docker_metadata: ~ - add_kubernetes_metadata: ~ #================================ Logging ===================================== # Sets log level. The default log level is info. # Available log levels are: error, warning, info, debug #logging.level: debug # At debug level, you can selectively enable logging only for some components. # To enable all selectors use ["*"]. Examples of other selectors are "beat", # "publish", "service". #logging.selectors: ["*"] #============================== X-Pack Monitoring =============================== # filebeat can export internal metrics to a central Elasticsearch monitoring # cluster. This requires xpack monitoring to be enabled in Elasticsearch. The # reporting is disabled by default. # Set to true to enable the monitoring reporter. monitoring.enabled: false # Sets the UUID of the Elasticsearch cluster under which monitoring data for this # Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch. #monitoring.cluster_uuid: # Uncomment to send the metrics to Elasticsearch. Most settings from the # Elasticsearch output are accepted here as well. # Note that the settings should point to your Elasticsearch *monitoring* cluster. # Any setting that is not set is automatically inherited from the Elasticsearch # output configuration, so if you have the Elasticsearch output configured such # that it is pointing to your Elasticsearch monitoring cluster, you can simply # uncomment the following line. #monitoring.elasticsearch: #================================= Migration ================================== # This allows to enable 6.7 migration aliases #migration.6_to_7.enabled: true #================================= Internal queue ============================= # queue.mem: events: 4096 flush.min_events: 128 ``` ---
**Author:** ![Gauthier\_Le\_Moulec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gauthier_le_moulec/32/60614_2.png) [@Gauthier\_Le\_Moulec](https://discuss.elastic.co/u/Gauthier_Le_Moulec)\ **Post date:** [March 9, 2020, 10:39am UTC](https://discuss.elastic.co/t/harvester-doesnt-start-when-filebeat-started-as-windows-service/222683/3 "2020-03-09T10:39:55Z")
And here is my filebeat.log file of the windows service... As you can see the harvester is not started and the connection with logstash is not tried to be established: ``` 2020-03-09T11:26:40.953+0100 INFO instance/beat.go:610 Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\ProgramData\filebeat] Logs path: [C:\ProgramData\filebeat\logs] 2020-03-09T11:26:40.956+0100 INFO instance/beat.go:618 Beat ID: 5dd5df21-1075-413b-bf29-41a861cb5bef 2020-03-09T11:26:40.968+0100 INFO [beat] instance/beat.go:941 Beat info {"system_info": {"beat": {"path": {"config": "C:\\Program Files\\Filebeat", "data": "C:\\ProgramData\\filebeat", "home": "C:\\Program Files\\Filebeat", "logs": "C:\\ProgramData\\filebeat\\logs"}, "type": "filebeat", "uuid": "5dd5df21-1075-413b-bf29-41a861cb5bef"}}} 2020-03-09T11:26:40.968+0100 INFO [beat] instance/beat.go:950 Build info {"system_info": {"build": {"commit": "a9c141434cd6b25d7a74a9c770be6b70643dc767", "libbeat": "7.5.2", "time": "2020-01-15T11:13:20.000Z", "version": "7.5.2"}}} 2020-03-09T11:26:40.968+0100 INFO [beat] instance/beat.go:953 Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.12.12"}}} 2020-03-09T11:26:40.973+0100 INFO [beat] instance/beat.go:957 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-01-10T13:04:42.35+01:00","name":"VDORYSIELK1","ip":["22.1.68.129/16","::1/128","127.0.0.1/8"],"kernel_version":"10.0.14393.3383 (rs1_release.191125-1816)","mac":["00:50:56:8a:d4:66"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2016 Standard","version":"10.0","major":10,"minor":0,"patch":0,"build":"14393.3384"},"timezone":"CET","timezone_offset_sec":3600,"id":"fa5f1e77-d088-4b61-a52c-906f55b5f1d0"}}} 2020-03-09T11:26:40.976+0100 INFO [beat] instance/beat.go:986 Process info {"system_info": {"process": {"cwd": "C:\\windows\\system32", "exe": "C:\\Program Files\\Filebeat\\filebeat.exe", "name": "filebeat.exe", "pid": 11276, "ppid": 760, "start_time": "2020-03-09T11:26:40.888+0100"}}} 2020-03-09T11:26:40.976+0100 INFO instance/beat.go:297 Setup Beat: filebeat; Version: 7.5.2 2020-03-09T11:26:40.976+0100 INFO [publisher] pipeline/module.go:97 Beat name: VDORYSIELK1 2020-03-09T11:26:40.977+0100 WARN beater/filebeat.go:152 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning. 2020-03-09T11:26:40.978+0100 INFO instance/beat.go:429 filebeat start running. 2020-03-09T11:26:40.978+0100 INFO [monitoring] log/log.go:118 Starting metrics logging every 30s 2020-03-09T11:26:40.979+0100 INFO registrar/registrar.go:145 Loading registrar data from C:\ProgramData\filebeat\registry\filebeat\data.json 2020-03-09T11:26:40.979+0100 INFO registrar/registrar.go:152 States Loaded from registrar: 0 2020-03-09T11:26:40.979+0100 WARN beater/filebeat.go:368 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning. 2020-03-09T11:26:40.979+0100 INFO crawler/crawler.go:72 Loading Inputs: 3 2020-03-09T11:26:40.980+0100 INFO log/input.go:152 Configured paths: [\\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\core\current\VDORYSIFME1_fmeserver.log] 2020-03-09T11:26:40.980+0100 INFO input/input.go:114 Starting input of type: log; ID: 3233485692626140888 2020-03-09T11:26:40.980+0100 INFO log/input.go:152 Configured paths: [\\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\core\current\VDORYSIFME1_fmescheduler.log] 2020-03-09T11:26:40.980+0100 INFO input/input.go:114 Starting input of type: log; ID: 3075276952488700912 2020-03-09T11:26:40.981+0100 INFO log/input.go:152 Configured paths: [\\clnas-ory-1-smbprod-adp-nt\apps$\IDG\FME\DEV\resources\logs\engine\current\jobs\*\*.log] 2020-03-09T11:26:40.981+0100 INFO input/input.go:114 Starting input of type: log; ID: 13971036041717848847 2020-03-09T11:26:40.981+0100 INFO crawler/crawler.go:106 Loading and starting Inputs completed. Enabled inputs: 3 2020-03-09T11:26:40.981+0100 INFO cfgfile/reload.go:171 Config reloader started 2020-03-09T11:26:43.964+0100 INFO add_cloud_metadata/add_cloud_metadata.go:89 add_cloud_metadata: hosting provider type not detected. 2020-03-09T11:27:10.980+0100 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":234,"time":{"ms":234}},"total":{"ticks":327,"time":{"ms":327},"value":327},"user":{"ticks":93,"time":{"ms":93}}},"handles":{"open":195},"info":{"ephemeral_id":"c7d4b135-74aa-4747-b2ea-abaeecbb4143","uptime":{"ms":30069}},"memstats":{"gc_next":8414400,"memory_alloc":4352752,"memory_total":11344760,"rss":34217984},"runtime":{"goroutines":38}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0},"reloads":2},"output":{"type":"logstash"},"pipeline":{"clients":3,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"cpu":{"cores":4}}}}} 2020-03-09T11:27:40.980+0100 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":375,"time":{"ms":141}},"total":{"ticks":484,"time":{"ms":157},"value":484},"user":{"ticks":109,"time":{"ms":16}}},"handles":{"open":197},"info":{"ephemeral_id":"c7d4b135-74aa-4747-b2ea-abaeecbb4143","uptime":{"ms":60068}},"memstats":{"gc_next":8414400,"memory_alloc":4461576,"memory_total":11453584,"rss":12288},"runtime":{"goroutines":38}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0},"reloads":3},"pipeline":{"clients":3,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}} ``` ---
**Author:** ![Gauthier\_Le\_Moulec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gauthier_le_moulec/32/60614_2.png) [@Gauthier\_Le\_Moulec](https://discuss.elastic.co/u/Gauthier_Le_Moulec)\ **Post date:** [March 9, 2020, 10:44am UTC](https://discuss.elastic.co/t/harvester-doesnt-start-when-filebeat-started-as-windows-service/222683/4 "2020-03-09T10:44:09Z")
When I launch filebeat from command line, the beat instance is not related to "ProgramData" directory... Should I modify the .ps1 install file in order to fix this particularity? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 6, 2020, 12:44pm UTC](https://discuss.elastic.co/t/harvester-doesnt-start-when-filebeat-started-as-windows-service/222683/5 "2020-04-06T12:44:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.