Running filebeat on windows

[AmirBL]

I want to run filebeat on windows 10 with Goland IDE. I download filebeat from https://github.com/elastic/beats then after editing the configuration file(filebeat.yml)

filebeat.prospectors:
 - type: log
   enabled: true
   paths:
      - c:\logfile\*.log
   fields:
        level: debug
        review: 1

output.logstash:
  hosts: ["MY_IP:Port"]

logging.level: info
logging.to_files: true
logging.files:
  path: c:\filebeatlogs
  name: filebeatlogs
  keepfiles: 8
  permissions: 0644

I run the main.go and the text in output file after some regular info on the top these errors was come in output file (https://www.dropbox.com/s/6mu5iu8dhyszd2m/filebeatlogs.txt?dl=0) that I addressing it in filebeat.yml :

ERROR instance/metrics.go:111 Error retrieving CPU percentages: error retrieving process stats
ERROR instance/metrics.go:67 Error while getting memory usage: error retrieving process stats
ERROR instance/metrics.go:147 Error retrieving load average: not implemented on windows

After I debuged it I think it was come from gosigar library that don't support some features in windows.
I run goland as administrator and then run main.go but it came again. in this page https://github.com/elastic/beats/tree/master/vendor/github.com/elastic/gosigar was shown that some feature like ProcExe was not exist in windows that my errors was come from it.

this is -e -d * output file (https://www.dropbox.com/s/qv8m0yiyypb0nqd/-e-d_Output.txt?dl=0)

Now ,what should I do? help me please.

[kvch (Noémi Ványi)]

Could you please share the full output of ./filebeat -e -d "*" e.g. the debug logs? Also, could you please share your config formatted using </>?

These error messages are coming from Filebeat's own state reporting.
Error retrieving load average: ... will be always present on windows, because it's not supported. However, the other two errors should not happen.

[kvch (Noémi Ványi)]

Indeed. ProcExe is not supported on Windows. Do you need internal metrics of Filebeat?
Because apart from that everything else seems to work based on your logs.

[kvch (Noémi Ványi)]

What is the error you see when compiling?

[AmirBL]

I changed my first message. I think it's more clear and brief.please take a look.

[adrisr (Adrian Serrano)]

First, this problems don't imply a problem with filebeat itself, but the internal metrics it reports in case you want to monitor filebeat with metricbeat. So unless you want this feature, you can safely ignore it.

Now, I think the problem itself comes from running filebeat from within Goland. Why would you want to do that?

Using Goland to edit beats code is supported (it's the editor I use), but running the beat from Goland is a different thing. You may be running in permission issues, even if Goland itself is elevated, the processes run from within goland may not inherit this elevation. Also if you're running in debug mode, it can cause additional problems.

If you just want to use beats under Windows, just download the precompiled binary.

If you want to make changes to beats, I suggest you use Goland to edit the code and build the beat from the command-line running make inside the beat directory. This will require you to install make (usually from cygwin) and have Go correctly setup.