Metricbeat service don't start (Win2019)


I'm trying to install metricbeat on a Windows Server 2019.
I'm using Elastic Metricbeat 7.8.0 installed with the .msi package.

I begin with:

.\metricbeat.exe setup
Overwritng ILM policy is disabled. Set `setup.ilm.overwrite:true`for enabling.

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

When I try to start the service with

start-service metricbeat

I get the error:

Service 'Elastic Metricbeat 7.8.0 (metricbeat)' cannot be started due to the following error: Cannot start service metricbeat on computer '.'.

I tried the following diagnostics:

.\metricbeat.exe test config
Config OK
.\metricbeat.exe test output
   parse url... OK
      parse host... OK
      dns lookup... OK
      dial up... OK
   TLS... WAN secure connection disabled
   talk to server... OK
   version: 7.8.0

I tried to look for more info in the system logs:

A timeout was reached (30000 milliseconds) while waiting for the Elastic Metricbeat 7.8.0 service to connect.

Here is my metricbeat.yml

path: ${path.config}\module**.yml
reload.enabled: false

index.number_of_shards: 1
index.codec: best_compression

host: ""

hosts: [""]


  • add_host_metadata: ~
  • add_cloud_metadata: ~
  • add_docker_metadata: ~
  • add_kubernetes_metadata: ~

What did I missed?


The following command:

.\metricbeat.exe -e -d "*"

does not return any error (I get messages with json output and messages like:

  • return ack to broker loop:x
  • done send ack
  • PublishEvents: x events have been published to elasticsearch in x.xms.

hi @DucretJe, can you enable debug logging and let us know if you see anything in the logs when starting metricbeat as a service?
Also, not sure what modules/metricsets you have enabled, can you limit those to one module/metricset just to rule out any issues there.
Are you running any antivirus atm? Can you disable it or whitelist the metricbeat service in this case?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.