I'm running metricbeat on four of our servers and they have been working for a couple of weeks. Until today where one of the machines stopped sending the windows services. I now only get a single event:
| @timestamp | Dec 7th, 11:28:35 | |
|---|---|---|
| t _id | NGk2iGcBkvVnaVY7Q4lf | |
| t _index | metricbeat-6.4.2-2018.12.07 | |
| # _score | - | |
| t _type | doc | |
| t beat.hostname | CENSORED | |
| t beat.name | CENSORED | |
| t beat.version | 6.4.2 | |
| t error.message | The system cannot find the file specified. | |
| t host.name | CENSORED | |
| t metricset.module | windows | |
| t metricset.name | service | |
| # metricset.rtt | 10001 | |
| t tags | conversions, application-tier |
This is the windows.yml file
- module: windows
metricsets:
- service
period: 1m
I tried running the metricbeat as an executable but there is no Err or Warn visible. It just sends out this event.
The host is running Windows 2012 Standard
Any idea on how to troubleshoot this? Thanks