# Not able to setup filebeat on windows server 2012 R2 **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 15, 2016, 6:34am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304 "2016-01-15T06:34:01Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Post date:** [January 15, 2016, 6:34am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/1 "2016-01-15T06:34:01Z")
I am trying to setup filebeat on windows server. filebeat version : filebeat-1.2.0-nightlylatest-windows I will brieg the steps I did.. 1. PS C:\Scripts\filebeat\> ./install-service-filebeat.ps1 Here I got some execution policy error on PS. I put All executionpolicy unrestricted, then I was able to run that script. 2. Edit filebeat.yml file: Below I put my file contents.. 3. Loading the Index Template in Elasticsearch : From here itself I am stuck. I use below command to do this... PS C:\Scripts\filebeat\filebeat\> Invoke-WebRequest -Method Put -InFile filebeat.template.json -Uri [http://192.168.2.6:9200/\_template/filebeat?pretty](http://192.168.2.6:9200/_template/filebeat?pretty) And the error message is.. Invoke-WebRequest : Unable to connect to the remote server At line:1 char:1 - Invoke-WebRequest -Method Put -InFile filebeat.template.json -Uri [http://192.168](http://192.168) ... - ```auto + CategoryInfo : NotSpecified: (:) [Invoke-WebRequest], WebException + FullyQualifiedErrorId : System.Net.WebException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ``` 1. I tried to start the filebeat service : PS C:\Scripts\filebeat\filebeat\> Start-Service filebeat But it simply goes to next line. I setup ELK on ubuntu 14.04. And here is my logstash configuration file (logstash-filter.conf) input { tcp{ port =\> 5044 type =\> "logs" } } filter { if [type] == "apache" { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } date { match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] } } } output { elasticsearch { hosts =\> ["localhost:9200"] } stdout { codec =\> rubydebug } } I don't know in which area I am wrong. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 15, 2016, 7:13am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/2 "2016-01-15T07:13:18Z")
> And the error message is.. > Invoke-WebRequest : Unable to connect to the remote server So... the service isn't running or there's a network issue preventing the connection. > PS C:\Scripts\filebeat\filebeat\> Start-Service filebeat > But it simply goes to next line. What did you expect should've happened? I haven't use Start-Service myself, but a successful start of a service shouldn't necessarily result in any output. ---
**Author:** ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Post date:** [January 15, 2016, 9:33am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/3 "2016-01-15T09:33:30Z")
I figure out the reason for connection error. I will make it clear soon. What are other methods to start filebeat.? Is there any problem with my filebeat.yml file? Because I am not getting any logs in logserver. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 15, 2016, 9:51am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/4 "2016-01-15T09:51:44Z")
> Is there any problem with my filebeat.yml file? If you post your configuration and format it as code it will be possible to review it. > Because I am not getting any logs in logserver. What does the Filebeat logfile say? You may need to increase the logging verbosity by starting Filebeat with (IRRC) `-v -d "*"`. ---
**Author:** ![carmelom](https://avatars.discourse-cdn.com/v4/letter/c/e19adc/32.png) [@carmelom](https://discuss.elastic.co/u/carmelom)\ **Post date:** [January 15, 2016, 12:27pm UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/5 "2016-01-15T12:27:14Z")
Thank you, for you time, I sort it out. ---
**Author:** ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Post date:** [January 16, 2016, 4:59am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/6 "2016-01-16T04:59:29Z")
Sorry for the delay. Below is my filebeat.yml file. ` paths: # - /var/log/*.log - C:\Program Files\Apache Software Foundation\Tomcat 7.0\logs* input_type: log document_type: apache registry_file: "C:/ProgramData/filebeat/registry" output: logstash: hosts: ["192.168.2.6:5044"] ` And my logstash configuration file (logstash-filter.conf) ` input { tcp{ port => 5044 type => "logs" } } filter { if [type] == "apache" { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } date { match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"] } } } output { elasticsearch { hosts => ["localhost:9200"] } stdout { codec => rubydebug } } ` ---
**Author:** ![babeesh](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Post date:** [January 16, 2016, 9:52am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/7 "2016-01-16T09:52:56Z")
Finally I managed to ship logs to logserver. Here What I did Edit /etc/elasticsearch/elasticsearch.yml `network.host : 0.0.0.0 http.port : 9200 ` Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304/8 "2017-07-05T21:56:37Z")