# Problems with winlogbeat

**URL:** <https://discuss.elastic.co/t/problems-with-winlogbeat/119436>\
**Category:** Logstash\
**Created:** [February 12, 2018, 9:16am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436 "2018-02-12T09:16:22Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![gaudi71240](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaudi71240/32/27678_2.png) [@gaudi71240](https://discuss.elastic.co/u/gaudi71240)\
**Post date:** [February 12, 2018, 9:16am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/1 "2018-02-12T09:16:22Z")

</div>

Hello i have install ELK Stack in version 6.2 with centos

when i want to send the logs of my windows server it goes this way at logstash service logs :

2018-02-09T10:20:40+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:40+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:40+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:41+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:41+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:41+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:42+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:42+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:42+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:43+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:43+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:43+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:44+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:44+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:44+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:45+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:45+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:45+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:46+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:46+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:46+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:47+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:47+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:47+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:48+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:48+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:49+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:50+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:50+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:50+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:51+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:51+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:51+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:52+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:52+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:52+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:53+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:53+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:53+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:54+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:54+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:54+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:55+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:55+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:55+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:56+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:56+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:56+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:57+01:00 ERR Failed to publish events: client is not connected  
2018-02-09T10:20:57+01:00 ERR Failed to publish events caused by: lumberjack protocol error  
2018-02-09T10:20:57+01:00 ERR Failed to publish events caused by: client is not connected  
2018-02-09T10:20:58+01:00 INFO Non-zero metrics in the last 30s: beat.info.uptime.ms=30007 beat.memstats.gc\_next=33277648 beat.memstats.memory\_alloc=28613136 beat.memstats.memory\_total=5302610656 libbeat.config.module.running=0 libbeat.output.events.batches=54 libbeat.output.events.failed=110592 libbeat.output.events.total=110592 libbeat.output.read.bytes=162 libbeat.output.write.bytes=7769140 libbeat.pipeline.clients=3 libbeat.pipeline.events.active=4119 libbeat.pipeline.events.retry=165888 uptime={"server\_time":"2018-02-09T09:20:58.621575Z","start\_time":"2018-02-09T08:54:58.3298457Z","uptime":"26m0.2917293s","uptime\_ms":"1560291729"}  
2018-02-09T10:21:01+01:00 INFO Stopping Winlogbeat  
2018-02-09T10:21:01+01:00 INFO EventLog[System] Stop processing.  
2018-02-09T10:21:01+01:00 INFO EventLog[Application] Stop processing.  
2018-02-09T10:21:01+01:00 INFO EventLog[Security] Stop processing.  
2018-02-09T10:21:01+01:00 INFO Total non-zero values: beat.info.uptime.ms=1562846 beat.memstats.gc\_next=33279568 beat.memstats.memory\_alloc=25416048 beat.memstats.memory\_total=5315037304 libbeat.config.module.running=0 libbeat.output.events.batches=2670 libbeat.output.events.failed=5468160 libbeat.output.events.total=5468160 libbeat.output.read.bytes=8010 libbeat.output.type=logstash libbeat.output.write.bytes=384536808 libbeat.output.write.errors=13 libbeat.pipeline.clients=0 libbeat.pipeline.events.active=4116 libbeat.pipeline.events.failed=284 libbeat.pipeline.events.published=4116 libbeat.pipeline.events.retry=8208384 libbeat.pipeline.events.total=4400 msg\_file\_cache.ApplicationHits=1487 msg\_file\_cache.ApplicationMisses=15 msg\_file\_cache.SecurityHits=1304 msg\_file\_cache.SecurityMisses=1 msg\_file\_cache.SystemHits=1588 msg\_file\_cache.SystemMisses=12 uptime={"server\_time":"2018-02-09T09:21:01.3609922Z","start\_time":"2018-02-09T08:54:58.3298457Z","uptime":"26m3.0311465s","uptime\_ms":"1563031146"}  
2018-02-09T10:21:01+01:00 INFO Uptime: 26m2.8461726s  
2018-02-09T10:21:01+01:00 INFO winlogbeat stopped.

do you have any idea what this can come from  
thanks for your help

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 12, 2018, 9:27am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/2 "2018-02-12T09:27:53Z")

</div>

What does your Logstash config look like? What does your Winlogbeat config look like?

---

<div class="post-metadata">

**Author:** ![gaudi71240](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaudi71240/32/27678_2.png) [@gaudi71240](https://discuss.elastic.co/u/gaudi71240)\
**Post date:** [February 12, 2018, 9:53am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/3 "2018-02-12T09:53:37Z")

</div>

for logstash i just changed the ip and for winlogbeat I put the logstash IP and the port

---

<div class="post-metadata">

**Author:** ![gaudi71240](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaudi71240/32/27678_2.png) [@gaudi71240](https://discuss.elastic.co/u/gaudi71240)\
**Post date:** [February 12, 2018, 9:55am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/4 "2018-02-12T09:55:23Z")

</div>

my config .cfg :

input {  
beats {  
port =\> 9600  
}  
}

output {  
if [type] == "wineventlog" {  
elasticsearch { hosts =\> ["[http://172.20.15.80:9200](http://172.20.15.80:9200)"]  
index =\> "logstash-winlogbeat-%{+YYYY.MM.dd}"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 12, 2018, 10:03am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/5 "2018-02-12T10:03:47Z")

</div>

In recent versions of Logstash I believe port 9600 is used by Logstash, so I am not sure a Beats plugin can use this. If so, there should be something in the Logstash logs though. Can you try using a different port?

---

<div class="post-metadata">

**Author:** ![gaudi71240](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaudi71240/32/27678_2.png) [@gaudi71240](https://discuss.elastic.co/u/gaudi71240)\
**Post date:** [February 12, 2018, 10:17am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/6 "2018-02-12T10:17:28Z")

</div>

i have this right now

2018-02-12T11:15:46+01:00 INFO Home path: [C:\Program Files\winlogbeat] Config path: [C:\Program Files\winlogbeat] Data path: [C:\ProgramData\winlogbeat] Logs path: [C:\ProgramData\winlogbeat\logs]  
2018-02-12T11:15:46+01:00 INFO Beat UUID: a0a3b61a-748d-417d-ac6c-7952dd8c7ef8  
2018-02-12T11:15:46+01:00 INFO Setup Beat: winlogbeat; Version: 6.1.3  
2018-02-12T11:15:46+01:00 INFO Beat name: RDS4  
2018-02-12T11:15:46+01:00 INFO State will be read from and persisted to C:\ProgramData\winlogbeat.winlogbeat.yml  
2018-02-12T11:15:46+01:00 INFO winlogbeat start running.  
2018-02-12T11:15:59+01:00 INFO Stopping Winlogbeat  
2018-02-12T11:15:59+01:00 INFO EventLog[System] Stop processing.  
2018-02-12T11:15:59+01:00 INFO EventLog[Application] Stop processing.  
2018-02-12T11:15:59+01:00 INFO EventLog[Security] Stop processing.  
2018-02-12T11:15:59+01:00 INFO Total non-zero values: beat.info.uptime.ms=12668 beat.memstats.gc\_next=27438992 beat.memstats.memory\_alloc=20666872 beat.memstats.memory\_total=104813784 libbeat.config.module.running=0 libbeat.output.type=logstash libbeat.pipeline.clients=0 libbeat.pipeline.events.active=4116 libbeat.pipeline.events.failed=284 libbeat.pipeline.events.published=4116 libbeat.pipeline.events.total=4400 msg\_file\_cache.ApplicationHits=1471 msg\_file\_cache.ApplicationMisses=30 msg\_file\_cache.ApplicationSize=30 msg\_file\_cache.SecurityHits=1202 msg\_file\_cache.SecurityMisses=1 msg\_file\_cache.SecuritySize=1 msg\_file\_cache.SystemHits=1688 msg\_file\_cache.SystemMisses=12 msg\_file\_cache.SystemSize=12 uptime={"server\_time":"2018-02-12T10:15:59.4108292Z","start\_time":"2018-02-12T10:15:46.7432977Z","uptime":"12.6675315s","uptime\_ms":"12667531"}  
2018-02-12T11:15:59+01:00 INFO Uptime: 12.668133s  
2018-02-12T11:15:59+01:00 INFO winlogbeat stopped.

---

<div class="post-metadata">

**Author:** ![gaudi71240](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaudi71240/32/27678_2.png) [@gaudi71240](https://discuss.elastic.co/u/gaudi71240)\
**Post date:** [February 12, 2018, 10:20am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/7 "2018-02-12T10:20:12Z")

</div>

and this

2018-02-12T11:18:38+01:00 INFO Home path: [C:\Program Files\winlogbeat] Config path: [C:\Program Files\winlogbeat] Data path: [C:\ProgramData\winlogbeat] Logs path: [C:\ProgramData\winlogbeat\logs]  
2018-02-12T11:18:38+01:00 INFO Metrics logging every 30s  
2018-02-12T11:18:38+01:00 INFO Beat UUID: a0a3b61a-748d-417d-ac6c-7952dd8c7ef8  
2018-02-12T11:18:38+01:00 INFO Setup Beat: winlogbeat; Version: 6.1.3  
2018-02-12T11:18:38+01:00 INFO Beat name: RDS4  
2018-02-12T11:18:38+01:00 INFO State will be read from and persisted to C:\ProgramData\winlogbeat.winlogbeat.yml  
2018-02-12T11:18:38+01:00 INFO winlogbeat start running.  
2018-02-12T11:19:01+01:00 ERR Failed to connect: dial tcp 172.20.15.80:9800: connectex: Une tentative de connexion a échoué car le parti connecté n’a pas répondu convenablement au-delà d’une certaine durée ou une connexion établie a échoué car l’hôte de connexion n’a pas répondu.  
2018-02-12T11:19:08+01:00 INFO Non-zero metrics in the last 30s: beat.info.uptime.ms=30093 beat.memstats.gc\_next=28292832 beat.memstats.memory\_alloc=18146736 beat.memstats.memory\_total=103518784 libbeat.config.module.running=0 libbeat.output.type=logstash libbeat.pipeline.clients=3 libbeat.pipeline.events.active=4119 libbeat.pipeline.events.published=4116 libbeat.pipeline.events.retry=2048 libbeat.pipeline.events.total=4119 msg\_file\_cache.ApplicationHits=1471 msg\_file\_cache.ApplicationMisses=30 msg\_file\_cache.ApplicationSize=30 msg\_file\_cache.SecurityHits=1201 msg\_file\_cache.SecurityMisses=1 msg\_file\_cache.SecuritySize=1 msg\_file\_cache.SystemHits=1688 msg\_file\_cache.SystemMisses=12 msg\_file\_cache.SystemSize=12 uptime={"server\_time":"2018-02-12T10:19:08.9926481Z","start\_time":"2018-02-12T10:18:38.9005668Z","uptime":"30.0920813s","uptime\_ms":"30092081"}  
2018-02-12T11:19:17+01:00 INFO Stopping Winlogbeat  
2018-02-12T11:19:17+01:00 INFO EventLog[System] Stop processing.  
2018-02-12T11:19:17+01:00 INFO EventLog[Application] Stop processing.  
2018-02-12T11:19:17+01:00 INFO EventLog[Security] Stop processing.  
2018-02-12T11:19:17+01:00 INFO Total non-zero values: beat.info.uptime.ms=38843 beat.memstats.gc\_next=28292832 beat.memstats.memory\_alloc=18891160 beat.memstats.memory\_total=104263208 libbeat.config.module.running=0 libbeat.output.type=logstash libbeat.pipeline.clients=0 libbeat.pipeline.events.active=4116 libbeat.pipeline.events.failed=284 libbeat.pipeline.events.published=4116 libbeat.pipeline.events.retry=2048 libbeat.pipeline.events.total=4400 msg\_file\_cache.ApplicationHits=1471 msg\_file\_cache.ApplicationMisses=30 msg\_file\_cache.ApplicationSize=30 msg\_file\_cache.SecurityHits=1201 msg\_file\_cache.SecurityMisses=1 msg\_file\_cache.SecuritySize=1 msg\_file\_cache.SystemHits=1688 msg\_file\_cache.SystemMisses=12 msg\_file\_cache.SystemSize=12 uptime={"server\_time":"2018-02-12T10:19:17.7418405Z","start\_time":"2018-02-12T10:18:38.9005668Z","uptime":"38.8412737s","uptime\_ms":"38841273"}  
2018-02-12T11:19:17+01:00 INFO Uptime: 38.8432908s  
2018-02-12T11:19:17+01:00 INFO winlogbeat stopped.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 12, 2018, 10:21am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/8 "2018-02-12T10:21:27Z")

</div>

Check the Logstash log to see if it is managing to start the pipeline properly. I suspect it is not.

Otherwise try changing the port number used.

---

<div class="post-metadata">

**Author:** ![gaudi71240](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaudi71240/32/27678_2.png) [@gaudi71240](https://discuss.elastic.co/u/gaudi71240)\
**Post date:** [February 12, 2018, 10:24am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/9 "2018-02-12T10:24:35Z")

</div>

i have this in my logs :  
[2018-02-12T00:00:02,208][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.  
Pipeline\_id:main  
Plugin: \<LogStash::Inputs::Beats port=\>9600, id=\>"5b4231270cc95ff9a050d800a1b854c520f4972ac0758099e07147549b5b820b", enable\_metric=\>true, codec=\>\<LogStash::Codecs::Plain id=\>"plain\_bbf407c5-5175-40b6-9c90-83dd8ce74d73", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, ssl\_verify\_mode=\>"none", include\_codec\_tag=\>true, ssl\_handshake\_timeout=\>10000, tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60, executor\_threads=\>8\>  
Error: event executor terminated

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 12, 2018, 10:27am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/10 "2018-02-12T10:27:33Z")

</div>

[Here is the link to the docs describing the use of the 9600 port](https://www.elastic.co/guide/en/logstash/6.2/monitoring.html). Change port number either for the plugin or the Logstash monitoring API.

---

<div class="post-metadata">

**Author:** ![gaudi71240](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaudi71240/32/27678_2.png) [@gaudi71240](https://discuss.elastic.co/u/gaudi71240)\
**Post date:** [February 12, 2018, 10:46am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/11 "2018-02-12T10:46:10Z")

</div>

thank you it works fine with the 9900 port

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2018, 10:47am UTC](https://discuss.elastic.co/t/problems-with-winlogbeat/119436/12 "2018-03-12T10:47:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.