# Issues running Filebeat on Windows **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 14, 2016, 3:58am UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343 "2016-04-14T03:58:43Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![jmcinnis](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jmcinnis](https://discuss.elastic.co/u/jmcinnis)\ **Post date:** [April 14, 2016, 3:58am UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/1 "2016-04-14T03:58:43Z")
Hi, I have a Windows 7 Client VM that I'm trying to run Filebeat on. I can run "Start-Service filebeat" without getting any errors, but when I look at the log file, it's having a connection failure. My ELK Stack is running on CentOS and I also have a CentOS Client VM which connects fine. I can post my Filebeat configuration for my CentOS client if necessary. I've added what I think are the necessary firewall exceptions and restarted the firewall and all necessary services on my ELK Server Log output: 2016-04-13T22:05:14-04:00 ERR SSL client failed to connect with: dial tcp 10.0.2.24:5044: connectex: A socket operation was attempted to an unreachable host. Configuration file: ``` filebeat: prospectors: - paths: - C:\Windows\System32\winevt\Logs\* # - /var/log/*.log input_type: log document_type: syslog registry_file: "C://ProgramData//filebeat//registry" output: logstash: hosts: ["10.0.2.24:5044"] bulk_max_size: 1024 index: filebeat tls: certificate_authorities: ["C:/logstash-forwarder.crt"] path: "filebeat.template.json" shipper: logging: files: rotateeverybytes: 10485760 # = 10MB ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 14, 2016, 4:00am UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/2 "2016-04-14T04:00:25Z")
Can you telnet to the LS host from windows? ---
**Author:** ![jmcinnis](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jmcinnis](https://discuss.elastic.co/u/jmcinnis)\ **Post date:** [April 14, 2016, 4:24am UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/3 "2016-04-14T04:24:22Z")
No. I can ping the LS host, but when I try to telnet 10.0.2.24:5044 via cygwin, I get "Can't lookup hostname 10.0.2.24:5044". ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 14, 2016, 5:34am UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/4 "2016-04-14T05:34:52Z")
That's because you should run `telnet 10.0.2.24 5044` and not `telnet 10.0.2.24:5044`. ---
**Author:** ![jmcinnis](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jmcinnis](https://discuss.elastic.co/u/jmcinnis)\ **Post date:** [April 14, 2016, 1:50pm UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/5 "2016-04-14T13:50:00Z")
Ah, ok. I tried again and it works when I type in the right command ---
**Author:** ![jmcinnis](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jmcinnis](https://discuss.elastic.co/u/jmcinnis)\ **Post date:** [April 14, 2016, 3:21pm UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/6 "2016-04-14T15:21:04Z")
I edited my filebeat config file because I had some spacing errors: ``` filebeat: prospectors: - paths: - C:\Windows\System32\winevt\Logs\* # - /var/log/*.log encoding: utf-8 input_type: log document_type: syslog registry_file: "C://ProgramData//filebeat//registry" output: logstash: hosts: ["10.0.2.24:5044"] bulk_max_size: 1024 index: filebeat tls: certificate_authorities: ["C:/logstash-forwarder.crt"] path: "filebeat.template.json" shipper: logging: files: rotateeverybytes: 10485760 # = 10MB ``` I now get the following error: `2016-04-13T23:47:00-04:00 ERR SSL client failed to connect with: dial tcp 10.0.2.24:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.` ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 15, 2016, 1:23pm UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/7 "2016-04-15T13:23:30Z")
can you post your logstash input config? Hmm... ```auto A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. ``` Is logstash running or some firewall inbetween? ---
**Author:** ![jmcinnis](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jmcinnis](https://discuss.elastic.co/u/jmcinnis)\ **Post date:** [April 15, 2016, 3:10pm UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/8 "2016-04-15T15:10:21Z")
Here's my 02-beats-input.conf: ``` input { beats { port => 5044 ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" } } ``` 10-syslog-filter: ``` filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ``` 30-elasticsearch-output.conf: ``` output { elasticsearch { hosts => ["localhost:9200"] sniffing => true manage_template => false index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } ``` ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 18, 2016, 11:02am UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/9 "2016-04-18T11:02:31Z")
SSL config looks ok (given certificates are valid). Can you try to `$ ping 10.0.2.24` and `telnet 10.0.2.24 5044`? I'd expect at least telnet not working (unresponsive), as beat is complaining about remote not responding. ---
**Author:** ![jmcinnis](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jmcinnis](https://discuss.elastic.co/u/jmcinnis)\ **Post date:** [April 18, 2016, 1:14pm UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/10 "2016-04-18T13:14:23Z")
I got it working. I switched to winlogbeat and had to convert my key from .key to .pfx (if I remember correctly). Then I had to use winscp to load the winlogbeat template to my server since Invoke-WebRequest wasn't working. Thanks for the help everyone! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343/11 "2017-07-05T21:53:07Z")