How to install filebeat as a service and start it everytime windows start?

[patrickian]

I'm installing filebeat in client PCs and basically, I don't want them seeing what filebeat does. I want to install it as a service in windows, run it everytime their machine starts and read from a defined directory (not default)

I've installed it as a service following the guide but if I'm not mistaken, I have to manually type in
Start-Service filebeat
to run the service and it doesn't read from the log file I defined in the prospector (it works if I start filebeat via the command line normally)

Is there a way to do this? Thank you

[andrewkroh]

Once you have enabled the filebeat service it will start-up automatically when the machine boots, so you do not need to continually run Start-Service filebeat. Give it a test, reboot the machine and see.

[patrickian]

Thanks. will give it a try in a while. Does it always use the configuration file in the filebeat root directory when it autostart?

[andrewkroh]

Yes, the path to the config file is specified in the service's properties.

[patrickian]

Thanks for the assistance. It's now running as a service and automatically starts during windows startup.

For those who will be having this issue in the future, here are the steps I did.

1.) Download and extract filebeat.
2.) Important create the configuration first.
3.) Install as service using Powershell.
4.) Start the service using Start-Service filebeat.
5.) You can now close the powershell window. It will automatically start now even when windows restart.

*I think the reason why it did not work for me before was that I installed the service before I did the configuration.