# Topbeat from Windows not sending logs to ELK stack **URL:** \ **Category:** Beats\ **Created:** [June 20, 2016, 7:59am UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281 "2016-06-20T07:59:37Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![iqbal\_nazir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iqbal_nazir/32/10216_2.png) [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Post date:** [June 20, 2016, 7:59am UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/1 "2016-06-20T07:59:37Z")
Hello, I have a working ELK stack running on Ubuntu 16.04. Filebeat and Topbeat from another Ubuntu client are successfully shipping logs to that ELK server. Even Winlogbeat is shipping events from a Windows machine. Then I was trying to make Filebeat and Topbeat work from Windows machine, but for some reason these are not working. When I open the logs in `C:\ProgramData\topbeat\Logs` , I see the following: `2016-06-20T09:17:09+02:00 ERR Error getting process details. pid=14072: error getting process arguments for pid=14072: could not get CommandLine: could not get Win32_Process WHERE ProcessId = 14072: Process not found 2016-06-20T09:17:09+02:00 ERR Error getting process details. pid=14036: error getting process arguments for pid=14036: could not get CommandLine: could not get Win32_Process WHERE ProcessId = 14036: Process not found 2016-06-20T09:20:39+02:00 ERR Error getting process details. pid=15780: error getting process arguments for pid=15780: could not get CommandLine: could not get Win32_Process WHERE ProcessId = 15780: Process not found 2016-06-20T09:20:39+02:00 ERR Error getting process details. pid=6696: error getting process arguments for pid=6696: could not get CommandLine: could not get Win32_Process WHERE ProcessId = 6696: Process not found` Can anyone please help on this regard? Best regards, Iqbal ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 20, 2016, 12:48pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/2 "2016-06-20T12:48:20Z")
Is Topbeat shipping any events? Can you enable debug logging and post your log file. The log lines above indicate a problem collecting the command line of only those processes. This can occur if those processes stopped in the middle of collection. Is this happening for all processes? ---
**Author:** ![iqbal\_nazir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iqbal_nazir/32/10216_2.png) [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Post date:** [June 21, 2016, 8:38am UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/3 "2016-06-21T08:38:51Z")
Hi, Thanks for the reply. I have set `logging` to `debug` , But I don't see any change. Could you please have a look at my config file and review that? * * * ``` input: period: 10 procs: - .* stats: cpu_per_core: false filesystem: true process: true system: true logging: files: rotateeverybytes: 10485760 level: debug output: elasticsearch: hosts: - "ELK_Server_IP:9200" shipper: ~ ``` ---
**Author:** ![iqbal\_nazir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iqbal_nazir/32/10216_2.png) [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Post date:** [June 21, 2016, 8:54am UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/4 "2016-06-21T08:54:23Z")
> [@andrewkroh](#): > > Is Topbeat shipping any events? I don't see Topbeat is sending any events. > [@andrewkroh](#): > > Is this happening for all processes? I get the same error log, whatever the `ProcessId` is. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 21, 2016, 1:08pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/5 "2016-06-21T13:08:49Z")
In your config, what is the `shipper: ~` that doesn't look like a valid option. Everything else looks normal. Can you run each of these queries against ES and post the output to confirm the number of events from topbeat. ```auto curl -XGET 'http://ELK_Server_IP:9200/topbeat-*/process/_count' curl -XGET 'http://ELK_Server_IP:9200/topbeat-*/filesystem/_count' curl -XGET 'http://ELK_Server_IP:9200/topbeat-*/system/_count' ``` Can you please post the debug logs from Topbeat somewhere (like gist or pastebin). ---
**Author:** ![iqbal\_nazir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iqbal_nazir/32/10216_2.png) [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Post date:** [June 21, 2016, 1:47pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/6 "2016-06-21T13:47:38Z")
Hey, This is the whole config file: --- input: period: 10 procs: - .\* stats: cpu\_per\_core: false filesystem: true process: true system: true logging: files: rotateeverybytes: 10485760 level: debug output: elasticsearch: hosts: - "ELK\_server\_IP:9200" shipper: logging: ``` level: debug files: rotateeverybytes: 10485760 # = 10MB ``` I have run the queries in ELK server and found the following result. I couldn't run them in Windows where Topbeat is running (maybe I don't know how to run them) Result for `process` query: `{ "count": 18073858, "_shards": { "total": 100, "successful": 100, "failed": 0 } }` Result for `filesystem` query: `{ "count": 2457273, "_shards": { "total": 100, "successful": 100, "failed": 0 } }` Result for `system` query: `{ "count": 161571, "_shards": { "total": 100, "successful": 100, "failed": 0 } }` As you can see Topbeat is actually shipping some events, but I don't think these events are from Windows client, rather Ubuntu client (I have an Ubuntu client where Topbeat is running and shipping). ---
**Author:** ![iqbal\_nazir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iqbal_nazir/32/10216_2.png) [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Post date:** [June 21, 2016, 1:49pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/7 "2016-06-21T13:49:04Z")
> [@andrewkroh](#): > > Can you please post the debug logs from Topbeat somewhere (like gist or pastebin). Sorry, I don't know how to do this as I am a newbie ☹ ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 21, 2016, 2:04pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/8 "2016-06-21T14:04:18Z")
I think the log file should be located at C:\ProgramData\topbeat\Logs\topbeat and you can paste that file to [pastebin.com](http://pastebin.com) and share it. The aggregation query will tell us what hosts are sending data and how many of each event type. ```auto curl -XGET 'http://ELK_server_IP:9200/topbeat-*/_search' -d' { "size": 0, "aggs": { "hosts": { "terms": { "field": "beat.hostname", "size": 0 }, "aggs": { "types": { "terms": { "field": "type", "size": 0, "order": { "_count": "desc" } } } } } } }' ``` ---
**Author:** ![iqbal\_nazir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iqbal_nazir/32/10216_2.png) [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Post date:** [June 21, 2016, 2:25pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/9 "2016-06-21T14:25:48Z")
> [@andrewkroh](#): > > I think the log file should be located at C:\ProgramData\topbeat\Logs\topbeat Please see the logs [here](https://gist.github.com/iqbal-nazir/9b52cd1de1ed1f1f134a38b1b56c1bdf). And if I run the aggregation query in Sense, I see events only from "rancid-test" which is my Ubuntu client. ![](https://us1.discourse-cdn.com/elastic/original/2X/9/92bffb0ae1e7e6953ebad112f4bce276a6209535.JPG) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 21, 2016, 2:37pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/10 "2016-06-21T14:37:32Z")
What version of Windows? What version of Topbeat? Did you start Topbeat as a Windows service? The logs look a little sparse. I expected a lot more data since its running with level: debug. Did you restart Topbeat after setting the level to debug. ---
**Author:** ![iqbal\_nazir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iqbal_nazir/32/10216_2.png) [@iqbal\_nazir](https://discuss.elastic.co/u/iqbal_nazir)\ **Post date:** [June 21, 2016, 3:42pm UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/11 "2016-06-21T15:42:40Z")
Windows 10 Enterprise Topbeat 1.2.3 Yes, Topbeat is running as Windows Service Yes, restarted too. Winlogbeat is shipping events successfully from the same machine. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 11, 2016, 7:59am UTC](https://discuss.elastic.co/t/topbeat-from-windows-not-sending-logs-to-elk-stack/53281/12 "2016-07-11T07:59:41Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.