# Issues with winlogbeat set up

**URL:** <https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 3, 2022, 2:59am UTC](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793 "2022-05-03T02:59:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\
**Post date:** [May 3, 2022, 2:59am UTC](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793/1 "2022-05-03T02:59:16Z")

</div>

ES version 7.16.2, winlogbeat 7.16.1

Trying to get winlogbeat working on a new cluster. We seem to have got thought the setup phase and started to send data. Each event gets a warning  
`(status=400): {"type":"illegal_argument_exception","reason":"pipeline with id [winlogbeat-7.16.1-routing] does not exist"}, dropping event!`

We have an index created ` winlogbeat-7.16.1-2022.05.03-000001` and are still running with the elevated privileges needed to do the initial setup.

No errors in the ES logs.

edit:

Hmmm... the ingestion pipeline appear to be a version 8 thing?? We did originally install winlogbeat 8.0 and saw the compatibility warning and reverted to 7.16.1  
and we must be using the 8.0 config

```auto
winlogbeat.event_logs:
  - name: ForwardedEvents
    tags: [forwarded]
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
output.elasticsearch:
  hosts: ["130.216.5.128:9200"]
  protocol: "https"
  api_key: "<redactected>"
  setup.ilm.check_exists: false
  pipeline: "winlogbeat-%{[agent.version]}-routing"
  output.elasticsearch.allow_older_versions: true
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 3, 2022, 6:59pm UTC](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793/2 "2022-05-03T18:59:07Z")

</div>

Winlogbeat 7 doesn't use the `pipeline`. See the docs for 7.17 below and compare that to the 8.x docs.

- 7.17 - [Modules | Winlogbeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/7.17/winlogbeat-modules.html#_usage_with_forwarded_events)
- 8.x - [Modules | Winlogbeat Reference [8.1] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/8.1/winlogbeat-modules.html#_usage_with_forwarded_events)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2022, 6:59pm UTC](https://discuss.elastic.co/t/issues-with-winlogbeat-set-up/303793/3 "2022-05-31T18:59:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.