# New winlogbeat seutp
**URL:** https://discuss.elastic.co/t/new-winlogbeat-seutp/91580
**Category:** Beats
**Tags:** winlogbeat
**Created:** [July 3, 2017, 2:12am UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580 "2017-07-03T02:12:11Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@waterwalker23](https://discuss.elastic.co/u/waterwalker23)
#### Post date: [July 3, 2017, 2:12am UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/1 "2017-07-03T02:12:11Z")
All,
Recently I've configured my first ELK server. It's capturing it's own logs fine. I want to use winlogbeat to send logs from my windows servers to my ELK server. Maybe i've missed something, but I've followed the winlogbeats documentation. When I run the configuration check it completes ok.
The issue is that logs are not populating in my kibana dashboard. What am I missing?
---
### Author:  [@waterwalker23](https://discuss.elastic.co/u/waterwalker23)
#### Post date: [July 3, 2017, 4:46am UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/2 "2017-07-03T04:46:11Z")
Here's the output I get when I run **.\import\_dashboards.exe -es [http://ELKserverIP:9200](http://ELKserverIP:9200)**
Error importing URL/file: Failed to import index-pattern: Failed to load directory C:\Users\ADMIN-~1\AppData\Local\Temp
7\tmp636719035\beats-dashboards-5.4.3\winlogbeat/index-pattern:
error loading C:\Users\ADMIN-~1\AppData\Local\Temp\7\tmp636719035\beats-dashboards-5.4.3\winlogbeat\index-pattern\winl
ogbeat.json: couldn't load json. Error: Put [http://ELKserverIP:9200/.kibana/index-pattern/winlogbeat-\*:](http://ELKserverIP:9200/.kibana/index-pattern/winlogbeat-*:) dial tcp ELKserverIP:9200: connectex: A connection attempt failed because the connected party did not properly respond after a period
of time, or established connection failed because connected host has failed to respond.
Exiting
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 4, 2017, 6:10pm UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/3 "2017-07-04T18:10:31Z")
> [@waterwalker23](#):
>
> dial tcp ELKserverIP:9200: connectex: A connection attempt failed because the connected party did not properly respond
Seems like the Elasticsearch server is not reachable. Are you able to access `http://ELKserverIP:9200` from the browser on the Winlogbeat host?
---
### Author:  [@ccampbell](https://discuss.elastic.co/u/ccampbell)
#### Post date: [July 5, 2017, 5:59pm UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/4 "2017-07-05T17:59:41Z")
Did you change the Elasticsearch configuration to use the server's IP address rather than 127.0.0.1? (the setting is in elasticsearch.yml)
Until you make that change, Elasticsearch is only accessible from the local system. Similarly, you'll need to change the kibana.yml (and logstash.yml, if you're using it) files so that you can view Kibana from external sources, and direct winlogbeat feeds through Logstash.
---
### Author:  [@waterwalker23](https://discuss.elastic.co/u/waterwalker23)
#### Post date: [July 6, 2017, 2:00am UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/5 "2017-07-06T02:00:30Z")
from my windows server and my laptop (same network) I am now able to point a browser to [http://ELKServerIP:9200](http://ELKServerIP:9200)
{
"name" : "syslog",
"cluster\_name" : "syslog",
"cluster\_uuid" : "bNHch5Y7RzqSP6JUBIyJSQ",
"version" : {
"number" : "5.4.3",
"build\_hash" : "eed30a8",
"build\_date" : "2017-06-22T00:34:03.743Z",
"build\_snapshot" : false,
"lucene\_version" : "6.5.1"
},
"tagline" : "You Know, for Search"
}
---
### Author:  [@waterwalker23](https://discuss.elastic.co/u/waterwalker23)
#### Post date: [July 6, 2017, 2:01am UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/6 "2017-07-06T02:01:33Z")
Yes, I have changed the .yml config files for kibana, elastisearch, and logstash to the servers IP. When i connect my browser to [http://serverIP:5601](http://serverIP:5601) the kibana dashboard opens, but when I go to discover (with winlogbeat-\*) as the index, it has nothing to display.
I know i'm missing something, just not sure what it is at the moment.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 6, 2017, 3:26pm UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/7 "2017-07-06T15:26:25Z")
Are there any errors in the Winlogbeat log file? And please share your Winlogbeat config.
---
### Author:  [@waterwalker23](https://discuss.elastic.co/u/waterwalker23)
#### Post date: [July 7, 2017, 2:16am UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/8 "2017-07-07T02:16:06Z")
Below are the configs for elasticsearch, logstash kibana (installed on linux). I'm down to extremely basic configurations. Here's my winlogbeat config as well from a 2102 Windows server.
* * *
```auto
winlogbeat config
#-----Event Logs -----
winlogbeat.event_logs:
- name: Application
ignore_older: 48h
- name: Security
ignore_older: 48h
- name: System
ignore_older: 48h
- name: Windows PowerShell
ignore_older: 48h
#-----Elasticsearch Output -----
output.elasticsearch:
hosts:
- 10.240.1.130:9200
logging.to_files: true
logging.files:
path: C:/ProgramData/winlogbeat/Logs
logging.level: info
#-----Logstash output -----
output.logstash:
hosts: ["10.240.1.130:5044"]
```
* * *
* * *
Kibana config
```auto
server.host: "10.240.1.130"
server.name: "bones"
elasticsearch.url: "http://10.240.1.130:9200"
```
* * *
* * *
Elasticsearch config
```auto
cluster.name: syslog
node.name: syslog
network.host: 10.240.1.130
http.port: 9200
```
* * *
* * *
Logstash config
```auto
node.name: syslog
http.host: "10.240.1.130"
```
* * *
---
### Author:  [@waterwalker23](https://discuss.elastic.co/u/waterwalker23)
#### Post date: [July 7, 2017, 2:18am UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/9 "2017-07-07T02:18:46Z")
Here's a small amount of errors in the winlogbeat log:
2017-07-06T21:11:55-05:00 INFO Non-zero metrics in the last 30s: uptime={"server\_time":"2017-07-07T02:11:55.5682649Z","start\_time":"2017-07-06T01:14:26.467413Z","uptime":"24h57m29.1008519s","uptime\_ms":"89849100851"}
2017-07-06T21:12:25-05:00 INFO Non-zero metrics in the last 30s: uptime={"server\_time":"2017-07-07T02:12:25.5669758Z","start\_time":"2017-07-06T01:14:26.467413Z","uptime":"24h57m59.0995628s","uptime\_ms":"89879099562"}
2017-07-06T21:12:48-05:00 ERR Connecting error publishing events (retrying): dial tcp 10.240.1.130:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2017-07-06T21:12:55-05:00 INFO Non-zero metrics in the last 30s: uptime={"server\_time":"2017-07-07T02:12:55.567702Z","start\_time":"2017-07-06T01:14:26.467413Z","uptime":"24h58m29.100289s","uptime\_ms":"89909100289"}
2017-07-06T21:13:25-05:00 INFO Non-zero metrics in the last 30s: uptime={"server\_time":"2017-07-07T02:13:25.5674082Z","start\_time":"2017-07-06T01:14:26.467413Z","uptime":"24h58m59.0999952s","uptime\_ms":"89939099995"}
2017-07-06T21:13:55-05:00 INFO Non-zero metrics in the last 30s: uptime={"server\_time":"2017-07-07T02:13:55.5671391Z","start\_time":"2017-07-06T01:14:26.467413Z","uptime":"24h59m29.0997261s","uptime\_ms":"89969099726"}
2017-07-06T21:14:09-05:00 ERR Connecting error publishing events (retrying): dial tcp 10.240.1.130:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2017-07-06T21:14:25-05:00 INFO Non-zero metrics in the last 30s: uptime={"server\_time":"2017-07-07T02:14:25.5668625Z","start\_time":"2017-07-06T01:14:26.467413Z","uptime":"24h59m59.0994495s","uptime\_ms":"89999099449"}
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [July 7, 2017, 2:39pm UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/10 "2017-07-07T14:39:33Z")
Are you wanting to send the event logs to Logstash or Elasticsearch? You have both outputs enabled so it is trying to deliver the event logs to both Logstash (which it cannot connect to) and to Elasticsearch. It will wait for Logstash to become available before continuing to read events so none of the outputs will receive events if any one of the outputs is unavailable.
Assuming you want to send directly to Elasticsearch (recommended when getting started), remove the Logstash output from the config and restart.
---
### Author:  [@waterwalker23](https://discuss.elastic.co/u/waterwalker23)
#### Post date: [July 7, 2017, 4:44pm UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/11 "2017-07-07T16:44:07Z")
Thanks Andrew that resolved the issue! Sorry for my confusion...I'm brand new to the ELK stack. I actually came across it in a linux training class.
My server logs are now displayed in kibana. Now I need to figure out how to set up some dashboards and get other servers added. Haven't even looked at setting up dashboards yet...
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 4, 2017, 4:44pm UTC](https://discuss.elastic.co/t/new-winlogbeat-seutp/91580/12 "2017-08-04T16:44:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.