Powershell can't start-service filebeat

Elastic Stack Beats
1

hello,

I had a problem, after I change es's password which used keystore value, the service can't run like this...

my filebeat.yml

variables:
  app_type: "API"
  logging_ip: "10.111.244.62"
filebeat.config:
  inputs:
    enabled: true
    path: ${path.config}/inputs.d/*.yml
processors:
  - decode_json_fields:
      fields: ["message"]
      process_array: false
      max_depth: 1
      target: ""
      overwrite_keys: true
      add_error_key: true
  - timestamp:
      field: logtime
      ignore_missing: false
      ignore_failure: false
      layouts:
        - "2006-01-02T15:04:05Z"
        - "2006-01-02T15:04:05.999Z"
        - "2006-01-02T15:04:05.999-07:00"
        - "2006-01-02T15:04:05.1234567-07:00"
  - drop_fields:
      fields: [logtime]
logging.level: debug
logging.to_files: true
logging.files:
  path: C:\SYSlog\Filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.template.name: "filebeat-%{[agent.version]}"
setup.template.pattern: "filebeat-%{[agent.version]}"
output.elasticsearch:
  hosts: ["https://10.111.244.64:9200"]  
  ssl: 
    verification_mode: none  
  index: "filebeat-%{[agent.version]}-${variables.app_type}-%{+yyyy.MM.dd}"
  username: elastic
  password: ${elasticpw}

had error

PS C:\Program Files\Filebeat> start-service filebeat
start-service : Service 'filebeat (filebeat)' cannot be started due to the following error: Cannot start service filebeat on computer '.'.
At line:1 char:1
+ start-service filebeat
+ ~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
    + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

PS C:\Program Files\Filebeat>
2

Hi @Zidane Welcome to the community.

Try to start filebeat in the foreground not as a service just to see what all the errors are

.\filebeat.exe

You can also try hard coding the password to make sure it works.

And then you did not show what commands you used to enter the password into the keystore.

1 Like
3

my step:

  • .\filebeat keystore create
  • .\filebeat keystore add elasticpw
    (and enter password)

and checked it

PS C:\Program Files\Filebeat> .\filebeat keystore list
elasticpw
PS C:\Program Files\Filebeat>
4

Start filebeat in the foreground so you can see all the logs / errors ... Show the entire startup

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.