Metricbeat service don't start (Win2019)

[DucretJe (Jerome Ducret)]

Hello,

I'm trying to install metricbeat on a Windows Server 2019.
I'm using Elastic Metricbeat 7.8.0 installed with the .msi package.

I begin with:

.\metricbeat.exe setup
Overwritng ILM policy is disabled. Set `setup.ilm.overwrite:true`for enabling.

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

When I try to start the service with

start-service metricbeat

I get the error:

Service 'Elastic Metricbeat 7.8.0 (metricbeat)' cannot be started due to the following error: Cannot start service metricbeat on computer '.'.

I tried the following diagnostics:

.\metricbeat.exe test config
Config OK
.\metricbeat.exe test output
elasticsearch: http://192.168.1.69:9200...
   parse url... OK
   connection...
      parse host... OK
      dns lookup... OK
      addresses: 192.168.1.69
      dial up... OK
   TLS... WAN secure connection disabled
   talk to server... OK
   version: 7.8.0

I tried to look for more info in the system logs:

A timeout was reached (30000 milliseconds) while waiting for the Elastic Metricbeat 7.8.0 service to connect.

Here is my metricbeat.yml

metricbeat.config.modules:
path: ${path.config}\module**.yml
reload.enabled: false

setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression

setup.kibana:
host: "192.168.1.69:5601"

output.elasticsearch:
hosts: ["192.168.1.69:9200"]

processors:

• add_host_metadata: ~
• add_cloud_metadata: ~
• add_docker_metadata: ~
• add_kubernetes_metadata: ~

What did I missed?

EDIT:

The following command:

.\metricbeat.exe -e -d "*"

does not return any error (I get messages with json output and messages like:

• return ack to broker loop:x
• done send ack
• PublishEvents: x events have been published to elasticsearch in x.xms.

[MarianaD]

hi @DucretJe, can you enable debug logging and let us know if you see anything in the logs when starting metricbeat as a service?
Also, not sure what modules/metricsets you have enabled, can you limit those to one module/metricset just to rule out any issues there.
Are you running any antivirus atm? Can you disable it or whitelist the metricbeat service in this case?