# Logstash not receiving logs from Winlogbeat 5.0 alpha

**URL:** <https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277>\
**Category:** Beats\
**Created:** [August 4, 2016, 7:33pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277 "2016-08-04T19:33:33Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 7:33pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/1 "2016-08-04T19:33:33Z")

</div>

upgraded winlogbeat to v 5.a and not I'm not able to receive any data to logstash see below error on log stash

D:\Elastic\logstash\bin\>logstash -f logstash.conf  
io/console not supported; tty will not be manipulated  
Settings: Default pipeline workers: 2  
←[31mInvalid setting for elasticsearch output plugin:

output {  
elasticsearch {  
# This setting must be a boolean  
# Expected boolean 'true' or 'false', got "True"  
manage\_template =\> "True"  
...  
}  
} {:level=\>:error}←[0m←[31mPipeline aborted due to error {:exception=\>#\<LogStash::ConfigurationError: Something is wrong with your configuration.\>, :backtrace=\>["D:/Elastic/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/config/mixin.rb:134:in `config_init'", "D:/Elastic/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/outputs/base.rb:63:in`initialize'", "D:/Elastic/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/output\_delegator.rb:74:in `register'", "D:/Elastic/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:181:in`start\_workers'", "org/jruby/RubyArray.java:1613:in `each'", "D:/Elastic/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:181:in`start\_workers'", "D:/Elastic/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/pipeline.rb:136:in `run'", "D:/Elastic/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.4-java/lib/logstash/agent.rb:473:in`start\_pipeline'"], :level=\>:error}←[0m  
stopping pipeline {:id=\>"main"}  
The signal HUP is in use by the JVM and will not work correctly on this platform

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 7:33pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/2 "2016-08-04T19:33:59Z")

</div>

this is my logstash.conf

```auto
input {
  beats {
    port => 5044
  }
 }
 output {
  elasticsearch {
    hosts => "192.168.110.100:9200"
    manage_template => True
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 7:34pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/3 "2016-08-04T19:34:55Z")

</div>

this is the winlog beat 5a config

```auto
winlogbeat.event_logs:
    - name: Application
    - name: Security
    - name: System
    - name: Active Directory
    - name: DFS Replication
    - name: Directory Service
    - name: DNS Server
    - name: File Replication Service
    - name: Key Management Service

output.logstash:
  # The Logstash hosts
  hosts: ["192.168.110.100:5044"]
  
    # Template name. By default the template name is winlogbeat.
  template.name: "winlogbeat"
  
    # Overwrite existing template
  template.overwrite: false

    # Path to template file
  template.path: C:\winlogbeat5\winlogbeat.template.json

logging.level: debug

```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 4, 2016, 7:51pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/4 "2016-08-04T19:51:57Z")

</div>

[This page](https://www.elastic.co/guide/en/beats/libbeat/1.2/logstash-installation.html#logstash-setup) contains a working example of what your Logstash configuration should look like for use with Beats.

As for your Winlogbeat configuration, those `template` options are not available when using the logstash output (they only work for the elasticsearch output). You must [manually install the index template](https://www.elastic.co/guide/en/beats/winlogbeat/5.0/winlogbeat-template.html#load-template-manually) to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 7:55pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/5 "2016-08-04T19:55:56Z")

</div>

this is the result when I try to install the plugin.. it was previously working... should I remove log stash completely ?

D:\Elastic\logstash\bin\>logstash-plugin install logstah-imput-beats  
io/console not supported; tty will not be manipulated  
Validating logstah-imput-beats  
Plugin logstah-imput-beats does not exist  
ERROR: Installation aborted, verification failed for logstah-imput-beats

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 4, 2016, 7:59pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/6 "2016-08-04T19:59:05Z")

</div>

For newer versions the plugin should already be included with Logstash. But in any case, you have a typo causing your problem: "imput" should be "input"

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 7:59pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/7 "2016-08-04T19:59:50Z")

</div>

note I had loaded the template manually with no problem earlier

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 8:36pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/8 "2016-08-04T20:36:45Z")

</div>

loaded that just now  
D:\Elastic\logstash\bin\>logstash-plugin install logstash-input-beats  
io/console not supported; tty will not be manipulated  
Validating logstash-input-beats  
Installing logstash-input-beats  
Installation successful

will start beats and see if its fixed

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 8:43pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/9 "2016-08-04T20:43:53Z")

</div>

ok I restarted the logstash and winlog beat and no index for winlogbeat

yellow open test 1 1 0 0 159b 159b  
yellow open .kibana 1 1 24 6 56kb 56kb

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 8:46pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/10 "2016-08-04T20:46:22Z")

</div>

FYI this was working with the current release of Winlogbeat

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 4, 2016, 8:47pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/11 "2016-08-04T20:47:17Z")

</div>

Did you delete the registry file used by Winlogbeat to persist it's read location? Try deleting `C:/ProgramData/winlogbeat/.winlogbeat.yml` to ensure there is data for Winlogbeat to read and send to Logstash.

Are there any errors in the Winlogbeat log file?

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 9:25pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/12 "2016-08-04T21:25:59Z")

</div>

I'm new to elastic so if you don't mind where is the log for the beat located. ?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 4, 2016, 9:28pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/13 "2016-08-04T21:28:55Z")

</div>

Check in `C:/ProgramData/winlogbeat/logs/`

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 9:31pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/14 "2016-08-04T21:31:24Z")

</div>

No log file for today and the service is running

---

<div class="post-metadata">

**Author:** ![alvaroca1](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\
**Post date:** [August 4, 2016, 9:35pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/15 "2016-08-04T21:35:20Z")

</div>

2016-08-04T17:32:08-04:00 INFO EventLog[System] Stop processing.  
2016-08-04T17:32:08-04:00 DBG WinEventLog[System] Closing handle  
2016-08-04T17:32:08-04:00 INFO EventLog[File Replication Service] Successfully published 100 events  
2016-08-04T17:32:08-04:00 INFO EventLog[File Replication Service] Stop processing.  
2016-08-04T17:32:08-04:00 DBG WinEventLog[File Replication Service] Closing handle  
2016-08-04T17:32:08-04:00 INFO EventLog[DNS Server] Stop processing.  
2016-08-04T17:32:08-04:00 DBG WinEventLog[DNS Server] Closing handle  
2016-08-04T17:32:08-04:00 INFO EventLog[Directory Service] Successfully published 100 events  
2016-08-04T17:32:08-04:00 INFO EventLog[Directory Service] Stop processing.  
2016-08-04T17:32:08-04:00 DBG WinEventLog[Directory Service] Closing handle  
2016-08-04T17:32:08-04:00 INFO EventLog[Application] Stop processing.  
2016-08-04T17:32:08-04:00 DBG WinEventLog[Application] Closing handle  
2016-08-04T17:32:08-04:00 INFO EventLog[DFS Replication] Stop processing.  
2016-08-04T17:32:08-04:00 DBG WinEventLog[DFS Replication] Closing handle  
2016-08-04T17:32:08-04:00 INFO EventLog[Security] Successfully published 100 events  
2016-08-04T17:32:08-04:00 INFO EventLog[Security] Stop processing.  
2016-08-04T17:32:08-04:00 DBG WinEventLog[Security] Closing handle  
2016-08-04T17:32:09-04:00 INFO EventLog[Key Management Service] Stop processing.  
2016-08-04T17:32:09-04:00 DBG WinEventLog[Key Management Service] Closing handle  
2016-08-04T17:32:09-04:00 DBG Checkpoint saved to disk. numUpdates=3  
2016-08-04T17:32:09-04:00 INFO winlogbeat cleanup  
2016-08-04T17:32:09-04:00 INFO Dumping runtime metrics...  
2016-08-04T17:32:09-04:00 INFO cmdline=["C:\winlogbeat5\\winlogbeat.exe","-c","C:\winlogbeat5\\winlogbeat.yml","-path.home","C:\winlogbeat5","-path.data","C:\\ProgramData\\winlogbeat"]  
2016-08-04T17:32:09-04:00 INFO dropReasons={}  
2016-08-04T17:32:09-04:00 INFO ignoredEvents={"Active Directory": 0, "Application": 0, "DFS Replication": 0, "DNS Server": 0, "Directory Service": 0, "File Replication Service": 0, "Key Management Service": 0, "Security": 0, "System": 0, "total": 0}  
2016-08-04T17:32:09-04:00 INFO libbeatEsPublishEventsCallCou

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 4, 2016, 9:47pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/16 "2016-08-04T21:47:20Z")

</div>

Based on those logs, it appears to be successfully publishing events to the output. The end of the log that provides metrics about each output is cut off. There should be a metric tell you how many events were ACK'ed by Logstash.

Next step is to check Logstash's log files. You could also start Logstash in the foreground and run it with the debug flag to get some addition information logged to stdout.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2016, 7:34pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-logs-from-winlogbeat-5-0-alpha/57277/17 "2016-08-25T19:34:13Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.