# Install filebeat on windows

**URL:** <https://discuss.elastic.co/t/install-filebeat-on-windows/81946>\
**Category:** Beats\
**Created:** [April 11, 2017, 9:31am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946 "2017-04-11T09:31:36Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 11, 2017, 9:31am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/1 "2017-04-11T09:31:36Z")

</div>

Hello everybody,

I'm trying to install filebeat on a windows server. But when I run it from the command prompt it shows me this :

 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/3/93f6fbfeb68640d92d56a8f65a2cf77345224bca.jpg)

Can anyone help me ?

Thannnks !

---

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [April 11, 2017, 9:58am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/2 "2017-04-11T09:58:19Z")

</div>

hi samir,  
Just run with the following command .  
.\install-service-filebeat.ps1

---

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [April 11, 2017, 9:59am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/3 "2017-04-11T09:59:02Z")

</div>

Look into filebeat doc

[https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html)

---

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 11, 2017, 11:31am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/4 "2017-04-11T11:31:46Z")

</div>

When I run this command it opens the script in a text file but doesn't execute it.

---

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [April 11, 2017, 11:38am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/5 "2017-04-11T11:38:10Z")

</div>

check your filebeat.yml file and configure properly.  
[https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration.html)

---

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [April 11, 2017, 11:41am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/6 "2017-04-11T11:41:48Z")

</div>

test your filebeat.yml by following command ./filebeat -configtest -e

---

<div class="post-metadata">

**Author:** ![Jonesthomas](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Post date:** [April 11, 2017, 11:49am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/7 "2017-04-11T11:49:16Z")

</div>

If you installed from DEB or RPM packages, run ./filebeat.sh -configtest -e.

---

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 11, 2017, 1:41pm UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/8 "2017-04-11T13:41:52Z")

</div>

I tested my configuration file. It is Ok. But despite that I can not install filebeat as a service.

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 11, 2017, 1:50pm UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/9 "2017-04-11T13:50:31Z")

</div>

Hi @Sam67000. What's wrong with that output? It shows that it has installed filebeat as service which is stopped. Look under services if `filebeat` is there.

---

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 11, 2017, 2:43pm UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/10 "2017-04-11T14:43:38Z")

</div>

Ah yes It's Ok thank you very much. But I have another problem when I want to load the template manually. I launch this command :

C:\Program Files\Filebeat\> Invoke-WebRequest -Method Put -InFile filebeat.template.json -Uri [http://localhost:9200/\_template/filebeat?pretty](http://localhost:9200/_template/filebeat?pretty)

But it puts me : invoke-webrequest is not recognized as an internal or external command, operable program or batch file.

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 11, 2017, 3:08pm UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/11 "2017-04-11T15:08:23Z")

</div>

You have to execute this with powershell. Open powershell or type `powershell` in a cmd and then enter.

---

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 12, 2017, 7:29am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/12 "2017-04-12T07:29:57Z")

</div>

Ah thank you ! we are moving forward.  
Now when I run it from the powershell it shows me the following error :

Invoke-WebRequest : Unable to connect to the remote server  
At line:1 char:1

- Invoke-WebRequest -Method Put -Infile filebeat.template.json -Uri [http://localho](http://localho) ...
- 

```auto
  + CategoryInfo : NotSpecified: (: [Invoke-WebRequest], WebException
  + FullyQualifiedErrorId : System.Net.WebException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
```

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 12, 2017, 7:32am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/13 "2017-04-12T07:32:23Z")

</div>

Is elasticsearch running on your machine?

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 12, 2017, 7:34am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/14 "2017-04-12T07:34:28Z")

</div>

If not replace `http://localhost:9200` with your elasticsearch machine.

---

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 12, 2017, 7:45am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/15 "2017-04-12T07:45:37Z")

</div>

I replace localhost with the IP address of my Elasticsearch machine right ?

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 12, 2017, 7:58am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/16 "2017-04-12T07:58:30Z")

</div>

👍

---

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 12, 2017, 8:27am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/17 "2017-04-12T08:27:28Z")

</div>

I did what you told me. Now it shows me another error : 😡

invoke-webrequest : InvokeThe response content cannot be parsed because the Internet Explorer engine is not available, or Internet Explorer's first-launch configuration is not complete.  
Specify the UseBasicParsing parameter and try again.

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 12, 2017, 8:29am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/18 "2017-04-12T08:29:46Z")

</div>

Try with param `-UseBasicParsing`

---

<div class="post-metadata">

**Author:** ![Sam67000](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@Sam67000](https://discuss.elastic.co/u/Sam67000)\
**Post date:** [April 12, 2017, 8:31am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/19 "2017-04-12T08:31:23Z")

</div>

Yes it worksssssssssssssss !!!!!!! Thanks a loooot !!

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [April 12, 2017, 8:33am UTC](https://discuss.elastic.co/t/install-filebeat-on-windows/81946/20 "2017-04-12T08:33:18Z")

</div>

Glad to hear that it works 👍

[Next page](https://discuss.elastic.co/t/install-filebeat-on-windows/81946.md?page=2)
