# Logstash "WMI" input plugin Error ==\> Error registering plugin **URL:** \ **Category:** Logstash\ **Created:** [January 20, 2018, 9:35am UTC](https://discuss.elastic.co/t/logstash-wmi-input-plugin-error-error-registering-plugin/116333 "2018-01-20T09:35:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![fsaas](https://avatars.discourse-cdn.com/v4/letter/f/ee7513/32.png) [@fsaas](https://discuss.elastic.co/u/fsaas)\ **Post date:** [January 20, 2018, 9:35am UTC](https://discuss.elastic.co/t/logstash-wmi-input-plugin-error-error-registering-plugin/116333/1 "2018-01-20T09:35:39Z")
Hello - What I'm trying to do I used to use ELK in a ubuntu Virtual Machine. but I need to use "WMI" input plugin that I can get windows OS information. So I decided to let logstash installed in windwos, and set logstash's output host to ubuntu VM. - The problem When I try to run logstash I had some errors. I'm thinking that this is because windows OS is not good environment to run logstash. So I followed this reference but it didn't work. [reference][Installing Logstash Plugins failing on Windows 10](https://discuss.elastic.co/t/installing-logstash-plugins-failing-on-windows-10/93287/8) - The root cause that i think [ERROR][logstash.pipeline] Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"\"select \* from Win32\_Process", interval=\>10, id=\>"3a4f43f5a2b446ce790f1efe0f59b45e2077410e1268a812dbb6583d654ace46", enable\_metric=\>true, codec=\>\"plain\_c4ead50b-c4b8-471a-9ec9-bfffa2b61ab2", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"localhost", namespace=\>"root\\cimv2"\>", :error=\>"undefined method `value' for nil:NilClass", :thread=\>"#\"} logstash configuration input { wmi { query =\> "select \* from Win32\_Process" interval =\> 10 } } output { elasticsearch { hosts =\> "168.188.127.122:9200" index=\> "wmi"} } if you want, I will upload the full error. does anyone know why this is happening? ---
**Author:** ![fsaas](https://avatars.discourse-cdn.com/v4/letter/f/ee7513/32.png) [@fsaas](https://discuss.elastic.co/u/fsaas)\ **Post date:** [January 20, 2018, 9:40am UTC](https://discuss.elastic.co/t/logstash-wmi-input-plugin-error-error-registering-plugin/116333/2 "2018-01-20T09:40:45Z")
This is the full error. PS C:\Users\SASL\Desktop\logstash-6.1.2\bin\> .\logstash.bat -f .\logstash.conf Sending Logstash's logs to C:/Users/SASL/Desktop/logstash-6.1.2/logs which is now configured via log4j2.properties [2018-01-20T18:13:14,234][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"fb\_apache", :directory=\>"C:/Users/SASL/Desktop/logstash-6.1.2/modules/fb\_apache/configuration"} [2018-01-20T18:13:14,257][INFO][logstash.modules.scaffold] Initializing module {:module\_name=\>"netflow", :directory=\>"C:/Users/SASL/Desktop/logstash-6.1.2/modules/netflow/configuration"} [2018-01-20T18:13:14,429][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2018-01-20T18:13:14,885][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.1.2"} [2018-01-20T18:13:15,263][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600} [2018-01-20T18:13:17,315][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>[[http://168.188.127.122:9200/](http://168.188.127.122:9200/)]}} [2018-01-20T18:13:17,325][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://168.188.127.122:9200/](http://168.188.127.122:9200/), :path=\>"/"} [2018-01-20T18:13:17,469][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[http://168.188.127.122:9200/](http://168.188.127.122:9200/)"} [2018-01-20T18:13:17,525][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>nil} [2018-01-20T18:13:17,548][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil} [2018-01-20T18:13:17,627][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}} [2018-01-20T18:13:17,683][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["[//168.188.127.122:9200](https://168.188.127.122:9200)"]} [2018-01-20T18:13:17,706][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>1000, :thread=\>"#\"} [2018-01-20T18:13:17,742][INFO][logstash.inputs.wmi] Registering wmi input {:query=\>"select \* from Win32\_Process"} [2018-01-20T18:13:22,770][ERROR][logstash.pipeline] Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"\"select \* from Win32\_Process", interval=\>10, id=\>"3a4f43f5a2b446ce790f1efe0f59b45e2077410e1268a812dbb6583d654ace46", enable\_metric=\>true, codec=\>\"plain\_c4ead50b-c4b8-471a-9ec9-bfffa2b61ab2", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"localhost", namespace=\>"root\\cimv2"\>", :error=\>"undefined method `value' for nil:NilClass", :thread=>"#"} [2018-01-20T18:13:23,583][ERROR][logstash.pipeline] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#, :backtrace=\>["C:/Users/SASL/Desktop/logstash-6.1.2/vendor/bundle/jruby/2.3.0/gems/logstash-input-wmi-3.0.3-java/lib/logstash/inputs/wmi.rb:65:in `register'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:343:in`register\_plugin'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:354:in `block in register_plugins'", "org/jruby/RubyArray.java:1734:in`each'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:354:in `register_plugins'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:510:in`start\_inputs'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:401:in `start_workers'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:288:in`run'", "C:/Users/SASL/Desktop/logstash-6.1.2/logstash-core/lib/logstash/pipeline.rb:248:in `block in start'"], :thread=\>"#\"} [2018-01-20T18:13:23,610][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: LogStash::PipelineAction::Create/pipeline\_id:main, action\_result: false", :backtrace=\>nil} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 17, 2018, 9:40am UTC](https://discuss.elastic.co/t/logstash-wmi-input-plugin-error-error-registering-plugin/116333/3 "2018-02-17T09:40:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.