# Logstash executable accepts filebeat data, but when installed as service not working with same conf files

**URL:** <https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792>\
**Category:** Logstash\
**Created:** [August 30, 2017, 6:03am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792 "2017-08-30T06:03:05Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 6:03am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/1 "2017-08-30T06:03:05Z")

</div>

Hi All,

I am in process of setting up ELK for monitoring my data. Elastic and Kibana is installed as service.

For testing purpose i had filebeat and logstash running from executable. I checked everything is working fine and so i tried to install both filebeat and logstash as service. Now all of sudden everything is stopped.

So to debug i uninstalled logstash as service. Ran it from executable, but no change. Then when i restart the filebeat service, logstash pickups the new change.

I need to install them as service. Can someone please help me here. For installing as service i used NSSM. Is there any setting required on service level?

Filebeat config:

```
filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
#- /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*
    #- C:\temp\sunny\*
    - C:\temp\DK\*
    - C:\temp\WW\*
    - C:\temp\NW\*
    - C:\temp\HS\*

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]
  
output.console:
  enabled: true

```

Logstash config:--

```
input {
  beats {
   port => 5044
   type => "log"
  }
}

filter {

  if [source] =~ "C:\\temp\\DK\\.*" {
  
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : Test run configuration: RunId: (?<runid>[^\s]*), Team: (?<Team>[^\s]*), FrameWork:CTFXUnit, Branch: (?<Branch>[^\s]*), Environment:(?<Environment>[^\s]*), Portal:(?<Portal>[^\s]*), Browser:(?<Browser_Type>[^\s]*), EnableDatabaseLog:True, EnableTestRailLog:True, TestRailConfiguration:Milestone: , TestRunType: TestPlan, TestPlan:(?<Test_Plan>[^\s]*), UpdateExistingTestRailRun: True., DebugLogLevel:2, TraitFilters:Name:Category, Operator:Equal, Value:Dothraki,"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} ERROR: \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	add_field => ["Trait_Value", "Dothraki"]
	}

  date {
    match => ["timestamp", "ISO8601"]
	remove_field => ["timestamp"]
	}

  if "_grokparsefailure" in [tags] 
  
  { drop {} }
	
  }

  if [source] =~ "C:\\temp\\WW\\.*" {
  
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : Test run configuration: RunId: (?<runid>[^\s]*), Team: (?<Team>[^\s]*), FrameWork:CTFXUnit, Branch: (?<Branch>[^\s]*), Environment:(?<Environment>[^\s]*), Portal:(?<Portal>[^\s]*), Browser:(?<Browser_Type>[^\s]*), EnableDatabaseLog:True, EnableTestRailLog:True, TestRailConfiguration:Milestone: , TestRunType: TestPlan, TestPlan:(?<Test_Plan>[^\s]*), UpdateExistingTestRailRun: True., DebugLogLevel:2, TraitFilters:Name:Category, Operator:Equal, Value:WhiteWalkers,"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} ERROR: \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	add_field => ["Trait_Value", "WhiteWalkers"]
	}

  date {
    match => ["timestamp", "ISO8601"]
	remove_field => ["timestamp"]
	}

  if "_grokparsefailure" in [tags] 
  
  { drop {} }
	
  }

  
  if [source] =~ "C:\\temp\\NW\\.*" {
  
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : Test run configuration: RunId: (?<runid>[^\s]*), Team: (?<Team>[^\s]*), FrameWork:CTFXUnit, Branch: (?<Branch>[^\s]*), Environment:(?<Environment>[^\s]*), Portal:(?<Portal>[^\s]*), Browser:(?<Browser_Type>[^\s]*), EnableDatabaseLog:True, EnableTestRailLog:True, TestRailConfiguration:Milestone: , TestRunType: TestPlan, TestPlan:(?<Test_Plan>[^\s]*), UpdateExistingTestRailRun: True., DebugLogLevel:2, TraitFilters:Name:Category, Operator:Equal, Value:NightsWatch,"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} ERROR: \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	add_field => ["Trait_Value", "NightsWatch"]
	}

  date {
    match => ["timestamp", "ISO8601"]
	remove_field => ["timestamp"]
	}

  if "_grokparsefailure" in [tags] 
  
  { drop {} }
	
  }
  
  
  
   if [source] =~ "C:\\temp\\HS\\.*" {
  
  grok {
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : Test run configuration: RunId: (?<runid>[^\s]*), Team: (?<Team>[^\s]*), FrameWork:CTFXUnit, Branch: (?<Branch>[^\s]*), Environment:(?<Environment>[^\s]*), Portal:(?<Portal>[^\s]*), Browser:(?<Browser_Type>[^\s]*), EnableDatabaseLog:True, EnableTestRailLog:True, TestRailConfiguration:Milestone: , TestRunType: TestPlan, TestPlan:(?<Test_Plan>[^\s]*), UpdateExistingTestRailRun: True., DebugLogLevel:2, TraitFilters:Name:Category, Operator:Equal, Value:HouseStark,"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} ERROR: \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} INFO : \[(?<Test_Run_Status>[^\s]*)\] LMS.XUnit.Tests.(?<Test_Name>[^\s]*)"}
	add_field => ["Trait_Value", "HouseStark"]
	}

  date {
    match => ["timestamp", "ISO8601"]
	remove_field => ["timestamp"]
	}

  if "_grokparsefailure" in [tags] 
  
  { drop {} }
	
  }
}

output {
  stdout {}
  elasticsearch {
	hosts => "localhost:9200"
	index => "logstash-json"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [August 30, 2017, 6:47am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/2 "2017-08-30T06:47:15Z")

</div>

> [@sunny1](#):
>
> hosts =\> "localhost:9200"

try this in your logstash config (i think it's the correct syntax : hosts =\> ["localhost:9200"]  
the "" are important.

> **[Elasticsearch output plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-hosts)**

if it doesn't work, can you give the error log pls ?

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 8:27am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/3 "2017-08-30T08:27:32Z")

</div>

Hello Rodolphe, thks for your reply. I am new to ELK. When i am running from console it always gives me error which i have attached here. Also please if you can guide me what configuration i can do to generate error log. I do see there is logstash.yml file and it says something about logging but i have no clue on how to pass the values. ![errorlogstash](https://us1.discourse-cdn.com/elastic/original/3X/0/9/091392920c3fc01693fa04990b2e06de33d7bb1a.PNG)

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 8:28am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/4 "2017-08-30T08:28:30Z")

</div>

FYI, i use to ignore the error msg and it still works fine from executable. But when i install it as service it does not work. I did the change u asked for but same result.

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 8:45am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/5 "2017-08-30T08:45:15Z")

</div>

Also logstash-plain.log and slow log both files are blank. what i did is i deleted those files from log folder and then restarted the logstash service. These files got created in log folder but they are empty. When i start from service it does write to these log files.

---

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [August 30, 2017, 8:50am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/6 "2017-08-30T08:50:56Z")

</div>

i'm running Logstash on centos so i don't really know how it is on windows, but, the error happen when you try to start logstash service ? ou when you try to start filebeat service ?

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 8:59am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/7 "2017-08-30T08:59:05Z")

</div>

I was just able to get log output. Hope this helps to see what issue is

![logstasherrorlog](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b64b98c80886992a5335ce028ed30e5f36622802.PNG)

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 9:08am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/8 "2017-08-30T09:08:51Z")

</div>

I think when i start logstash as service its not able to find my logstash.conf file.

---

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [August 30, 2017, 9:14am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/9 "2017-08-30T09:14:07Z")

</div>

did you informed the path.config in your logstash.yml file then ?

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 9:28am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/10 "2017-08-30T09:28:46Z")

</div>

No you are right i have not specified it. my logstash.conf is at below location

C:\Users\sgorasia\Downloads\logstash-5.5.1.2\logstash-5.5.1\bin

So what would be the format i need to give in logstash.yml file? Please advise

![pathconfig](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e12ffb455ed65ce2742f01a672630b59f37e47ee.PNG)

---

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [August 30, 2017, 9:36am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/11 "2017-08-30T09:36:21Z")

</div>

it should be :  
path.config: "C:\Users\sgorasia\Downloads\logstash-5.5.1.2\logstash-5.5.1\bin"  
(without the "#" on the line)

look here it can be helpful :  
[https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html](https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html)

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 9:48am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/12 "2017-08-30T09:48:13Z")

</div>

i tried entering the value as u mentioned but now something went wrong. log file is empty again.

 ![pathconfigforlogstash](https://us1.discourse-cdn.com/elastic/original/3X/3/9/399add532485035f2ee2c1285e37f80c2ab179c7.PNG)

---

<div class="post-metadata">

**Author:** ![Rodolphe\_Redoute](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@Rodolphe\_Redoute](https://discuss.elastic.co/u/Rodolphe_Redoute)\
**Post date:** [August 30, 2017, 9:52am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/13 "2017-08-30T09:52:21Z")

</div>

delete the "logstash.conf" you need a path to the directory, not a path to the file itself

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 30, 2017, 9:57am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/14 "2017-08-30T09:57:43Z")

</div>

Yaml is also sensitive to indentation, and it looks like you have a space ahead of your line that you should remove.

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 10:02am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/15 "2017-08-30T10:02:32Z")

</div>

Guys did as mentioned and got new error msg now.

Error msg:

[2017-08-30T15:30:54,738][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<ArgumentError: Setting "" hasn't been registered\>, :backtrace=\>["C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/settings.rb:32:in `get_setting'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/settings.rb:64:in`set\_value'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/settings.rb:83:in `merge'", "org/jruby/RubyHash.java:1342:in`each'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/settings.rb:83:in `merge'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/settings.rb:135:in`validate\_all'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/runner.rb:244:in `execute'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in`run'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/runner.rb:209:in `run'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in`run'", "C:\Users\sgorasia\Downloads\logstash-5.5.1.2\logstash-5.5.1\lib\bootstrap\environment.rb:71:in `(root)'"]}  
 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/6/1/61d253fc43ea29dc8e010c30049ba504fbdfa4a7.PNG)

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 10:27am UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/16 "2017-08-30T10:27:25Z")

</div>

I changed the way i was specifying path.config value and it gave different error this time

Error:  
[2017-08-30T15:55:13,640][ERROR][logstash.agent] Cannot create pipeline {:reason=\>"Expected one of #, input, filter, output at line 3, column 1 (byte 26) after #!/usr/bin/env bin/ruby\n\n", :backtrace=\>["C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:59:in `initialize'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:156:in`initialize'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/agent.rb:286:in `create_pipeline'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/agent.rb:95:in`register\_pipeline'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/runner.rb:314:in `execute'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in`run'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/logstash-core/lib/logstash/runner.rb:209:in `run'", "C:/Users/sgorasia/Downloads/logstash-5.5.1.2/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in`run'", "C:\Users\sgorasia\Downloads\logstash-5.5.1.2\logstash-5.5.1\lib\bootstrap\environment.rb:71:in `(root)'"]}  
[2017-08-30T15:55:13,643][DEBUG][logstash.agent] starting agent  
[2017-08-30T15:55:13,646][DEBUG][logstash.agent] Starting puma  
[2017-08-30T15:55:13,646][DEBUG][logstash.instrument.periodicpoller.os] PeriodicPoller: Stopping  
[2017-08-30T15:55:13,647][DEBUG][logstash.instrument.periodicpoller.jvm] PeriodicPoller: Stopping  
[2017-08-30T15:55:13,648][DEBUG][logstash.instrument.periodicpoller.persistentqueue] PeriodicPoller: Stopping

![Capture](https://us1.discourse-cdn.com/elastic/original/3X/9/7/97aa2ee0e81eb84e8d7c86f631d3f4459bd028ae.PNG)

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [August 30, 2017, 2:04pm UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/17 "2017-08-30T14:04:59Z")

</div>

Part of the issue is that this is a YAML file, and you have an indent (even a single space is an indent). `path.config` should be all the way to the left, with no preceding space.

Next, there should be a space after the colon, and you should not be looking in the `bin` directory. Your line should look more like

```auto
path.config: "C:\Users\sgorasia\Downloads\logstash-5.5.1.2\logstash-5.5.1\my_configuration"

```

...where `my_configuration` is where the pipeline files are found, e.g. `logstash.conf`. As Logstash looks at all files in this directory, it is not appropriate to point it to the `bin` directory. This directory does not need to exist within the Logstash installation path, and could instead be something like `C:\Users\sgorasia\Documents\Logstash`

---

<div class="post-metadata">

**Author:** ![sunny1](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Post date:** [August 30, 2017, 7:08pm UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/18 "2017-08-30T19:08:41Z")

</div>

Alright guys it works now. Thanks Aaron, Christian and Rodolphe.

Syntax is

```
 path.config: C:\Users\sgorasia\Downloads\logstash-5.5.1.2\logstash-5.5.1\logstash_grok
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 27, 2017, 7:08pm UTC](https://discuss.elastic.co/t/logstash-executable-accepts-filebeat-data-but-when-installed-as-service-not-working-with-same-conf-files/98792/19 "2017-09-27T19:08:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.