# Running filebeat on windows

**URL:** <https://discuss.elastic.co/t/running-filebeat-on-windows/141039>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 22, 2018, 4:09pm UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039 "2018-07-22T16:09:00Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![AmirBL](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@AmirBL](https://discuss.elastic.co/u/AmirBL)\
**Post date:** [July 22, 2018, 4:09pm UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039/1 "2018-07-22T16:09:00Z")

</div>

I want to run filebeat on windows 10 with Goland IDE. I download filebeat from [https://github.com/elastic/beats](https://github.com/elastic/beats) then after editing the configuration file(filebeat.yml)

```
filebeat.prospectors:
 - type: log
   enabled: true
   paths:
      - c:\logfile\*.log
   fields:
        level: debug
        review: 1

output.logstash:
  hosts: ["MY_IP:Port"]

logging.level: info
logging.to_files: true
logging.files:
  path: c:\filebeatlogs
  name: filebeatlogs
  keepfiles: 8
  permissions: 0644

```

I run the main.go and the text in output file after some regular info on the top these errors was come in output file ([https://www.dropbox.com/s/6mu5iu8dhyszd2m/filebeatlogs.txt?dl=0](https://www.dropbox.com/s/6mu5iu8dhyszd2m/filebeatlogs.txt?dl=0)) that I addressing it in filebeat.yml :

ERROR instance/metrics.go:111 Error retrieving CPU percentages: error retrieving process stats  
ERROR instance/metrics.go:67 Error while getting memory usage: error retrieving process stats  
ERROR instance/metrics.go:147 Error retrieving load average: not implemented on windows

After I debuged it I think it was come from gosigar library that don't support some features in windows.  
I run goland as administrator and then run main.go but it came again. in this page [https://github.com/elastic/beats/tree/master/vendor/github.com/elastic/gosigar](https://github.com/elastic/beats/tree/master/vendor/github.com/elastic/gosigar) was shown that some feature like ProcExe was not exist in windows that my errors was come from it.

this is -e -d \* output file ([https://www.dropbox.com/s/qv8m0yiyypb0nqd/-e-d\_Output.txt?dl=0](https://www.dropbox.com/s/qv8m0yiyypb0nqd/-e-d_Output.txt?dl=0))

Now ,what should I do? help me please.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [July 23, 2018, 3:09pm UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039/2 "2018-07-23T15:09:28Z")

</div>

Could you please share the full output of `./filebeat -e -d "*"` e.g. the debug logs? Also, could you please share your config formatted using `</>`?

These error messages are coming from Filebeat's own state reporting.  
`Error retrieving load average: ...` will be always present on windows, because it's not supported. However, the other two errors should not happen.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [July 25, 2018, 3:38pm UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039/5 "2018-07-25T15:38:03Z")

</div>

Indeed. `ProcExe` is not supported on Windows. Do you need internal metrics of Filebeat?  
Because apart from that everything else seems to work based on your logs.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [July 26, 2018, 8:11am UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039/7 "2018-07-26T08:11:48Z")

</div>

What is the error you see when compiling?

---

<div class="post-metadata">

**Author:** ![AmirBL](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@AmirBL](https://discuss.elastic.co/u/AmirBL)\
**Post date:** [July 30, 2018, 9:57am UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039/8 "2018-07-30T09:57:16Z")

</div>

I changed my first message. I think it's more clear and brief.please take a look.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 30, 2018, 2:28pm UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039/9 "2018-07-30T14:28:50Z")

</div>

First, this problems don't imply a problem with filebeat itself, but the internal metrics it reports in case you want to monitor filebeat with metricbeat. So unless you want this feature, you can safely ignore it.

Now, I think the problem itself comes from running filebeat from within Goland. Why would you want to do that?

Using Goland to edit beats code is supported (it's the editor I use), but running the beat from Goland is a different thing. You may be running in permission issues, even if Goland itself is elevated, the processes run from within goland may not inherit this elevation. Also if you're running in debug mode, it can cause additional problems.

If you just want to use beats under Windows, just download the precompiled binary.

If you want to make changes to beats, I suggest you use Goland to edit the code and build the beat from the command-line running `make` inside the beat directory. This will require you to install make (usually from cygwin) and have Go correctly setup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 2:28pm UTC](https://discuss.elastic.co/t/running-filebeat-on-windows/141039/10 "2018-08-27T14:28:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
