# Having Issue Starting Winlogbeat As A Windows Service

**URL:** https://discuss.elastic.co/t/having-issue-starting-winlogbeat-as-a-windows-service/260574
**Category:** Beats
**Tags:** winlogbeat
**Created:** [January 8, 2021, 7:56pm UTC](https://discuss.elastic.co/t/having-issue-starting-winlogbeat-as-a-windows-service/260574 "2021-01-08T19:56:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![qcjacobo](https://avatars.discourse-cdn.com/v4/letter/q/e99b99/32.png) [@qcjacobo](https://discuss.elastic.co/u/qcjacobo)
#### Post date: [January 8, 2021, 7:56pm UTC](https://discuss.elastic.co/t/having-issue-starting-winlogbeat-as-a-windows-service/260574/1 "2021-01-08T19:56:31Z")

</div>

I am having issues getting winlogbeat to start as a Windows service on my Windows 10 (1909) system. As you can see below, I am not getting any obvious errors when trying to install and start the Windows service. Just that the service will not start.

_PS C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86\_64\> .\install-service-winlogbeat.ps1_

_Status Name DisplayName_  
_------ ---- -----------_  
_Stopped winlogbeat winlogbeat_

_PS C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86\_64\> Start-Service winlogbeat_  
_PS C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86\_64\> Get-Service winlogbeat_

_Status Name DisplayName_  
_------ ---- -----------_  
_Stopped winlogbeat winlogbeat_

I am able to run winlogbeat from command line successfully and can see winlogbeat logs in kibana.

---

<div class="post-metadata">

### Author: ![qcjacobo](https://avatars.discourse-cdn.com/v4/letter/q/e99b99/32.png) [@qcjacobo](https://discuss.elastic.co/u/qcjacobo)
#### Post date: [January 8, 2021, 8:22pm UTC](https://discuss.elastic.co/t/having-issue-starting-winlogbeat-as-a-windows-service/260574/2 "2021-01-08T20:22:18Z")

</div>

So i looked at the winlogbeat log file and am seeing this error:

```auto
2021-01-08T12:09:19.639-0800	INFO	[monitoring]	log/log.go:154	Uptime: 232.2918ms
2021-01-08T12:09:19.639-0800	INFO	[monitoring]	log/log.go:131	Stopping metrics logging.
2021-01-08T12:09:19.640-0800	INFO	instance/beat.go:452	winlogbeat stopped.
2021-01-08T12:09:19.643-0800	ERROR	instance/beat.go:956	Exiting: error connecting to Kibana: fail to load the TLS config: 2 errors: open /certs/lab.crt: The system cannot find the path specified. /certs/lab.crt; open /certs/ca.crt: The system cannot find the path specified. reading <nil>

```

So I changed my yaml to the full path of the certificates:

```auto
*# =================================== Kibana ===================================*
*setup.kibana:*
* host: https://lab:5601*
* ssl.enabled: true*
* setup.kibana.ssl.verification_mode: none*
* ssl.certificate_authorities: "C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86_64\config\certs\ca.crt"*
* ssl.certificate: "C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86_64\config\certs\lab.crt"*
* ssl.key: "C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86_64\config\certs\lab.key"*
*# ---------------------------- Elasticsearch Output ----------------------------*
*output.elasticsearch:*
* hosts: "https://lab:9200"*
* username: "elastic" *
* password: "passwordhere"*
* output.elastic.ssl.certificate_authorities: "C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86_64\config\certs\ca.crt"*
* output.elastic.ssl.key: "C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86_64\config\certs\lab.key"*

```

But now I am getting the following error:

```auto
C:\elk\7.10.1\beats\winlogbeat-7.10.1-windows-x86_64>winlogbeat.exe test config -c .\winlogbeat.yml -e
Exiting: error loading config file: yaml: line 46: found unknown escape character

```

What path should I be specifying?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2021, 10:22pm UTC](https://discuss.elastic.co/t/having-issue-starting-winlogbeat-as-a-windows-service/260574/3 "2021-02-05T22:22:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
