# Running on Windows - Not logging Kibana

**URL:** <https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 18, 2018, 1:36pm UTC](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569 "2018-07-18T13:36:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 18, 2018, 1:36pm UTC](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569/1 "2018-07-18T13:36:50Z")

</div>

Hello,  
I was running filebeat on linux and forwarding the logs to logstash  
I then deleted the Linux one and installed one on Windows.  
I then started the service and it ran fine, then I checked on Kibana it was only displaying the Linux logs but not properly:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/4/5497c214c3e6cc040fd1206a29cad1790e3dbd9f.png)

This is my filebeat config:

```
#=========================== Filebeat inputs =============================
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - C:\Windows\System32\winevt\Logs\*
#============================= Filebeat modules ===============================

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
#==================== Elasticsearch template setting ==========================
setup.template.settings:
  index.number_of_shards: 3
#============================== Dashboards =====================================
setup.dashboards.enabled: true
#============================== Kibana =====================================
setup.kibana:
  host: "ip:5601"
#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts: ["ip:5044"]

```

Any clues to why its not logging the logs I set it to log and instead its still showing Linux ones?  
Note: I already deleted all filebeat logs with the following command:

`PowerShell.exe Invoke-RestMethod -Method Delete http://10.130.233.242:9200/filebeat-*`

Therefore, I have no idea to why it still showing.

edit1: something really weird is happening. I can run filebeat fine on Powershell, but when I go to services.msc it says its not running and if I try to run from there it says: Windows could not start the filebeat service on Local Computer.

edit2: fixed the issue by running these commands on Dev Tools:

```
 PUT _settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }
    
PUT filebeat-6.3.1-2018.07.18/_settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }
    
PUT filebeat-*/_settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }

```

The only issue is that Filebeat is not displaying anything on Kibana Discover, its almost like it's not selecting anything:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a08b1f9326cdb107c6289e558b549fa59a6570f9.png)  
and i've put a year to date on time range. So it should be display something. If I go to Managemenet and select filebeat-\* it doesn't even select filebeat:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ff3b7621f9114c6f463d2f00451c9ffaa33be9e3.png)  
Then if I try to index anything on filebeat, for example todays logs. It gives me this:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/0/303253bf8abc3f223006d886a115fb56a043380c.png)  
and the same goes for Logstash. Winlogbeat works fine though.

edit3: This is what it says when I try to open FIlebeat on discover:

```
blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];

 Less Info
OK
Error: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];
    at http://ip:5601/bundles/commons.bundle.js:3:428829
    at processQueue (http://10.130.233.242:5601/bundles/vendors.bundle.js:133:134252)
    at http://ip:5601/bundles/vendors.bundle.js:133:135201
    at Scope.$digest (http://ip:5601/bundles/vendors.bundle.js:133:146077)
    at Scope.$apply (http://ip:5601/bundles/vendors.bundle.js:133:148856)
    at done (http://ip:5601/bundles/vendors.bundle.js:133:101124)
    at completeRequest (http://ip:5601/bundles/vendors.bundle.js:133:106024)
    at XMLHttpRequest.xhr.onload (http://ip:5601/bundles/vendors.bundle.js:133:106783)
```

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [July 18, 2018, 9:53pm UTC](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569/2 "2018-07-18T21:53:08Z")

</div>

It sounds like there are some permissions issues going on. Can you post the results of`GET 'http://localhost:9200/_settings'` and `GET 'http://localhost:9200/filebeat-*/_settings'` (you can use the console in the kibana dev tools to do this).

It might also be interesting to try shipping data to a fresh ES install. My guess is that there's some bad setting remaining, probably the read\_only setting. My guess is that you weren't able to successfully reset that, or that some other process is overwriting your manual changes.

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [July 18, 2018, 10:07pm UTC](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569/3 "2018-07-18T22:07:46Z")

</div>

This could also be ES running low on disk space. Have you checked the ES logs?

ES will continue to put these indices into a closed state if you're running close to your disk limits.

---

<div class="post-metadata">

**Author:** ![Marcos\_Felix](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_felix/32/32486_2.png) [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\
**Post date:** [July 19, 2018, 3:48pm UTC](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569/4 "2018-07-19T15:48:10Z")

</div>

> [@Andrew\_Cholakian1](#):
>
> It sounds like there are some permissions issues going on. Can you post the results of `GET 'http://localhost:9200/_settings'` and `GET 'http://localhost:9200/filebeat-*/_settings'` (you can use the console in the kibana dev tools to do this).
> 
> It might also be interesting to try shipping data to a fresh ES install. My guess is that there's some bad setting remaining, probably the read\_only setting. My guess is that you weren't able to successfully reset that, or that some other process is overwriting your manual changes.

Sorry for the late reply, but I was able to get filebeat to read those logs. Problem is... this is what it is displaying:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b21d5ee5c474104bdbaa4e34da5fd07acdd62b95.png)  
is this normal? I was expecting it to read it like the event viewer logs

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2018, 3:53pm UTC](https://discuss.elastic.co/t/running-on-windows-not-logging-kibana/140569/5 "2018-08-16T15:53:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.