Packetbeat installation problem

Elastic Stack Beats
1

PS C:\Program Files\Packetbeat> PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-packetbeat.ps1.

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Program Files\Packetbeat\install-service-packetbeat.ps1?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"): R

__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 5
PSComputerName :

__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 1
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
ReturnValue : 0
PSComputerName :

Status : Stopped
Name : packetbeat
DisplayName : packetbeat

has the packet beat installed ?
when i try to run the command
./packetbeat -e -c packetbeat.yml
there is not output.
even when i try to test if the config file is okay by using
./packetbeat -configtest packetbeat.yml i dont get any output

2

Hi @Saketh_Chandra_Kolis,

To start packetbeat in windows you have to run:

PS CPS C:\Program Files\Packetbeat> Start-Service packetbeat

By default the log files are stored in C:\ProgramData\packetbeat\Logs.

See https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-starting.html

3 
PS C:\> cd 'Program Files\Packetbeat'
PS C:\Program Files\Packetbeat> Start-Service packetbeat
Start-Service : Service 'packetbeat (packetbeat)' cannot be started due to the following error: Cannot start service
packetbeat on computer '.'.
At line:1 char:1
+ Start-Service packetbeat
+ ~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service],
   ServiceCommandException
    + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
4

hi @exekias
Packetbeat is installed but i am still facing problems.

5

hi,
Also when i tried to run ./packetbeat -e -c packetbeat.yml -d "elasticsearch" I get no output.Is there any problem with the installation or the .yml fie.Please help

PS C:> cd 'Program Files\Packetbeat'
PS C:\Program Files\Packetbeat> ./packetbeat -e -c packetbeat.yml -d "elasticsearch"
PS C:\Program Files\Packetbeat>
Thanks!

6

Hi,

With the package from https://www.elastic.co/downloads/beats/packetbeat I get output executing your commands.

What package did you install to C:\Program Files\packetbeat? What is the packetbeat version you're trying to run?

Did you install WinPCAP as required by https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-installation.html#win ?

7

hi,
i didn't install winpcap..nw its working

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.