# Kibana, Winlogbeat Agent-search with custom variable
**URL:** https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102
**Category:** Beats
**Tags:** winlogbeat
**Created:** [March 6, 2023, 3:52pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102 "2023-03-06T15:52:32Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)
#### Post date: [March 6, 2023, 3:52pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102/1 "2023-03-06T15:52:32Z")
Hi,
I am new to the forum.
For some time now, we have been unable to search with our custom variables for winlogbeat logs on only two servers. I have restarted the winlog agent service but the problem still persist.
Any recommendation? Thanks
SAMY.
---
### Author:  [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)
#### Post date: [March 7, 2023, 2:02pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102/2 "2023-03-07T14:02:59Z")
Hi SAMY. Can you share more information? I do not understand the question.
---
### Author:  [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)
#### Post date: [March 7, 2023, 8:42pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102/3 "2023-03-07T20:42:33Z")
Hi,
From KIBANA-Discover Onglet, we unable to search event log windows with our custom variables/pattern , agent beat used is Winlogbeat,
this issue is appear just in two server, for other server we don't have this issue
exp our customer variable : rq.machinename
Picture 1 : issue
Picture 2 : No issue
error identify in log agent Winlogbeat :
2023-03-07T14:38:42.398-0500 ERROR [logstash] logstash/async.go:280 Failed to publish events caused by: write tcp 172.30.169.11:62412-\>172.30.230.23:5044: wsasend: Une connexion existante a dû être fermée par l’hôte distant.
2023-03-07T14:38:44.053-0500 ERROR [publisher\_pipeline\_output] pipeline/output.go:180 failed to publish events: write tcp 172.30.169.11:62412-\>172.30.230.23:5044: wsasend: Une connexion existante a dû être fermée par l’hôte distant.
test telnet :
Telnet 172.30.230.23:5044 OK
Thanks for help
---
### Author:  [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)
#### Post date: [March 8, 2023, 2:22pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102/4 "2023-03-08T14:22:47Z")
The errors from Winlogbeat indicate the remote host is closing the connection. However, there are many reasons this could occur. I would start by comparing the configuration of Winlogbeat for each server. Perhaps you have misconfigured one of the server? Are you connecting via HTTPS?
I'm fairly certain this is not a Kibana issue, so I'm going to move it to the Beats forum for a more appropriate audience.
---
### Author:  [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)
#### Post date: [March 8, 2023, 9:20pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102/5 "2023-03-08T21:20:33Z")
Hi,
yes connecting with https.
After comparing the configuration of Winlogbeat for each server i confirm that no misconfgured detected
Thanks
---
### Author:  [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)
#### Post date: [March 17, 2023, 1:50pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102/6 "2023-03-17T13:50:05Z")
anyone can answer it?
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 14, 2023, 1:50pm UTC](https://discuss.elastic.co/t/kibana-winlogbeat-agent-search-with-custom-variable/327102/7 "2023-04-14T13:50:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.