# How to get the logs from Cloud windows server to vmware ubuntu 14 ELK server

**URL:** <https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 18, 2017, 12:15pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707 "2017-04-18T12:15:39Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![onlybalu](https://avatars.discourse-cdn.com/v4/letter/o/d2c977/32.png) [@onlybalu](https://discuss.elastic.co/u/onlybalu)\
**Post date:** [April 18, 2017, 12:15pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/1 "2017-04-18T12:15:40Z")

</div>

Hi Team,

How to get the logs from Cloud windows server to vmware ubuntu 14 ELK server.....

Its very urgent basis....

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 18, 2017, 12:28pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/2 "2017-04-18T12:28:30Z")

</div>

A good place to begin is the [Winlogbeat Getting Started Guide](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html).

---

<div class="post-metadata">

**Author:** ![onlybalu](https://avatars.discourse-cdn.com/v4/letter/o/d2c977/32.png) [@onlybalu](https://discuss.elastic.co/u/onlybalu)\
**Post date:** [April 18, 2017, 2:23pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/3 "2017-04-18T14:23:16Z")

</div>

Hi Andrew,

Thanks for your reply, I configured in Cloud instance windows 2008 r2 server ( Client ). but Sever in VMware pc ( ELK server).

Find the below error from Windows client in cloud

2017-04-18T11:21:33+01:00 DBG Disable stderr logging  
2017-04-18T11:21:33+01:00 INFO Home path: [C:\Program Files\Winlogbeat] Config path: [C:\Program Files\Winlogbeat] Data path: [C:\ProgramData\winlogbeat] Logs path: [C:\Program Files\Winlogbeat\logs]  
2017-04-18T11:21:33+01:00 INFO Setup Beat: winlogbeat; Version: 5.0.2  
2017-04-18T11:21:33+01:00 DBG Processors:  
2017-04-18T11:21:33+01:00 DBG Initializing output plugins  
2017-04-18T11:21:33+01:00 INFO Max Retries set to: 3  
2017-04-18T11:21:33+01:00 INFO Activated logstash as output plugin.  
2017-04-18T11:21:33+01:00 DBG Create output worker  
2017-04-18T11:21:33+01:00 DBG No output is defined to store the topology. The server fields might not be filled.  
2017-04-18T11:21:33+01:00 INFO Publisher name: HBWEB03  
2017-04-18T11:21:33+01:00 INFO Flush Interval set to: 1s  
2017-04-18T11:21:33+01:00 INFO Max Bulk Size set to: 1024  
2017-04-18T11:21:33+01:00 DBG create bulk processing worker (interval=1s, bulk size=1024)  
2017-04-18T11:21:33+01:00 INFO State will be read from and persisted to C:\ProgramData\winlogbeat.winlogbeat.yml  
2017-04-18T11:21:33+01:00 DBG Using highest priority API, wineventlog, for event log Security  
2017-04-18T11:21:33+01:00 DBG Initialized EventLog[Security]  
2017-04-18T11:21:33+01:00 DBG Using highest priority API, wineventlog, for event log Application  
2017-04-18T11:21:33+01:00 DBG Initialized EventLog[Application]  
2017-04-18T11:21:33+01:00 DBG Using highest priority API, wineventlog, for event log Security  
2017-04-18T11:21:33+01:00 DBG Initialized EventLog[Security]  
2017-04-18T11:21:33+01:00 INFO winlogbeat start running.  
2017-04-18T11:21:33+01:00 DBG Windows is interactive: false  
2017-04-18T11:21:33+01:00 DBG WinEventLog[Security] using subscription query=  
  
\*[System[TimeCreated[timediff(@SystemTime) \<= 7200000]]]

2017-04-18T15:14:33+01:00 DBG EventLog[Security] Read() returned 0 records  
2017-04-18T15:14:33+01:00 INFO No non-zero metrics in the last 30s  
2017-04-18T15:14:34+01:00 ERR Connecting error publishing events (retrying): dial tcp 192.168.6.103:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.  
2017-04-18T15:14:34+01:00 DBG send fail

Regards,  
Balasubramaniam

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 18, 2017, 2:39pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/4 "2017-04-18T14:39:28Z")

</div>

> [@onlybalu](#):
>
> ERR Connecting error publishing events (retrying): dial tcp 192.168.6.103:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

There is a connection failure to your Logstash server. Check that the server is running. Can you ping the IP from the Windows host? Can you telnet to port 5044 on the LS server from the Windows host?

---

<div class="post-metadata">

**Author:** ![onlybalu](https://avatars.discourse-cdn.com/v4/letter/o/d2c977/32.png) [@onlybalu](https://discuss.elastic.co/u/onlybalu)\
**Post date:** [April 18, 2017, 3:03pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/5 "2017-04-18T15:03:04Z")

</div>

Hi Andrew,

Iam new to cloud instance, getting confused. Any other way to communicate cloud windows to vmware ubuntu server.

---

<div class="post-metadata">

**Author:** ![onlybalu](https://avatars.discourse-cdn.com/v4/letter/o/d2c977/32.png) [@onlybalu](https://discuss.elastic.co/u/onlybalu)\
**Post date:** [April 18, 2017, 3:09pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/6 "2017-04-18T15:09:08Z")

</div>

My Winlog Config file@windows client below,

```auto
winlogbeat.event_logs:
   - name: Security
     ignore_older: 2h
     event_id: 4727, 4731, 4754, 4726
   - name: Application
     ignore_older: 2h
   - name: Security
     ignore_older: 2h
output.logstash:
  hosts: ["192.168.6.103:5044"]
  bulk_max_size: 1024
  index: winlogbeat

  tls:
    certificate_authorities: ['C:/ProgramData/winlogbeat/logstash-forwarder.crt']

logging.to_files: true
logging.files:
   path: C:/ProgramData/winlogbeat/Logs
logging.level: debug

```

Regards,  
Balasubramaniam

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 18, 2017, 3:17pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/7 "2017-04-18T15:17:49Z")

</div>

> [@onlybalu](#):
>
> Any other way to communicate cloud windows to vmware ubuntu server.

The two machines must have IP connectivity in order for Winlogbeat to push message to Logstash.

`192.168.6.103` is an internal IP address. Are the two hosts running on the same network? Does the LS server have a public IP address that you need to be using instead?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2017, 3:29pm UTC](https://discuss.elastic.co/t/how-to-get-the-logs-from-cloud-windows-server-to-vmware-ubuntu-14-elk-server/82707/8 "2017-05-16T15:29:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.