# Logstash, Filebeat and Winlogbeat

**URL:** <https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746>\
**Category:** Logstash\
**Created:** [July 5, 2018, 2:17pm UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746 "2018-07-05T14:17:46Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 5, 2018, 2:17pm UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/1 "2018-07-05T14:17:47Z")

</div>

Is there any good tutorials out there with good configuration to install these tools so that I can ship event logs to my Kibana interface?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [July 5, 2018, 2:38pm UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/2 "2018-07-05T14:38:29Z")

</div>

Moved to Logstash forum as you will likely get a better answer there.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 5, 2018, 5:07pm UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/3 "2018-07-05T17:07:10Z")

</div>

I believe there's pretty good starter documentation on [elastic.co](http://elastic.co). If it's incomplete please tell us what's missing.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 6, 2018, 9:46am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/4 "2018-07-06T09:46:31Z")

</div>

do you know how I can update ELK without having to reinstall everything?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 6, 2018, 10:12am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/5 "2018-07-06T10:12:54Z")

</div>

I am following the conf file in elastic website:

```
input {
  file {
    path => "/tmp/access_log"
    start_position => "beginning"
  }
}

filter {
  if [path] =~ "access" {
    mutate { replace => { "type" => "apache_access" } }
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
  }
  date {
    match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
  stdout { codec => rubydebug }
}

```

I don't have a access\_log dir, should I make one? this is the dir that will keep all apache logs right? if someone doesn't have an apache\_log is there an alternative?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 11:27am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/6 "2018-07-06T11:27:22Z")

</div>

> do you know how I can update ELK without having to reinstall everything?

The easiest way of upgrading the Elastic stack components depends on your operating system and how you've installed the software.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 11:29am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/7 "2018-07-06T11:29:39Z")

</div>

> I don't have a access\_log dir, should I make one? this is the dir that will keep all apache logs right? if someone doesn't have an apache\_log is there an alternative?

What are you trying to do here?

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 6, 2018, 11:43am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/8 "2018-07-06T11:43:05Z")

</div>

I have installed using wget, I tried with the key but didn't work.  
I am following the logstash config file. It works, I created the file and added the log samples there. Logstash is processing it and adding to Kibana. I will update here if anything else comes up

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 6, 2018, 2:01pm UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/9 "2018-07-06T14:01:41Z")

</div>

I am getting this error attempt to configtest the syslog from: [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html)

```
root@root1-virtual-machine:/etc/logstash/conf.d# /usr/share/logstash/bin/logstash -f logstash-syslog.conf
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Sending Logstash's logs to /usr/share/logstash/logs which is now configured via log4j2.properties[2018-07-06T14:02:42,979][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-06T14:02:43,121][FATAL][logstash.runner] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2018-07-06T14:02:43,148][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

```

There are no instance running, I only telnet from another shell as the tutorial said.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 6, 2018, 7:27pm UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/10 "2018-07-06T19:27:28Z")

</div>

As the error message

> Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.

indicates you can't run multiple Logstash instances that share the same data directory. The `path.data` setting in logstash.yml or the `--path.data` command line option can change the data directory.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 9, 2018, 8:25am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/11 "2018-07-09T08:25:34Z")

</div>

I have used that, but it only works once and then the error persists.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 9, 2018, 10:54am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/12 "2018-07-09T10:54:07Z")

</div>

I have been following the tutorial to get Winlogbeat installed, and I got stuck on this bit:  
[https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-template.html#load-template-manually](https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-template.html#load-template-manually).  
Whenever I run this command:

`PS > .\winlogbeat.exe setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'`

I get this error:

```
Get-Process : Parameter cannot be processed because the parameter name 'E' is ambiguous. Possible matches include:
-ErrorAction -ErrorVariable.
At line:1 char:40
+ PS > .\winlogbeat.exe setup --template -E output.logstash.enabled=fal ...
+ ~~
    + CategoryInfo : InvalidArgument: (:) [Get-Process], ParameterBindingException
    + FullyQualifiedErrorId : AmbiguousParameter,Microsoft.PowerShell.Commands.GetProcessCommand

```

Any clues?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 9, 2018, 11:28am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/13 "2018-07-09T11:28:07Z")

</div>

No idea. Asking in the [Winlogbeat category](https://discuss.elastic.co/c/beats/winlogbeat) might be more fruitful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2018, 11:28am UTC](https://discuss.elastic.co/t/logstash-filebeat-and-winlogbeat/138746/14 "2018-08-06T11:28:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.