"plain\_6c4a974d-e114-4f30-99fb-a0cd8c0e4b8f", enable\_metric=\>true, charset=\>"UTF-8"\>,
host=\>"0.0.0.0", ssl=\>false, ssl\_verify\_mode=\>"none", include\_codec\_tag=\>true, ssl\_handshake\_timeout=\>10000, congestion\_threshold=\>5, target\_field\_for\_codec=\>"message", tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_E
CDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60\> Error: Address already in use: bind
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 20, 2017, 8:03pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/7 "2017-04-20T20:03:40Z")
> [@Greenie](#):
>
> Error: Address already in use: bind
Is another instance of Logstash already running? Something is using port 5044.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 20, 2017, 8:25pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/8 "2017-04-20T20:25:23Z")
You were correct...even thou the service was stopped and I had killed the powershell command I ran it still had open sessions when I ran netstat -ano, so I rebooted. Once the server came back up I made sure the logstash service was disabled and then ran the pwrshell command again. To summarize it seemed to start processing winevents from the client system, but did still have this same error from above.
[Ruby-0-Thread-5: C:/ELK/logstash-5.3.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:222] INFO logstash.outputs.elasticsearch - Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/), :path=\>"/"}09:51:47.640 [Ruby-0-Thread-5: C:/ELK/logstash-5.3.0/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-6.2.6-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:222] WARN logstash.outputs.elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>#, :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=\>"Elasticsearch Unreachable: [[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)][Manticore::SocketException] Connection refused: connect"}
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 20, 2017, 8:29pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/9 "2017-04-20T20:29:42Z")
That must be for the X-Pack monitoring feature of Logstash because you don't even have an elasticsearch output in your config file. So I think it is safe to ignore those for the moment. You can [come back to that](https://www.elastic.co/guide/en/x-pack/current/monitoring-logstash.html) after you get the data path working.
So now that you are getting events into Logstash you can try enabling the elasticsearch output to get the Winlogbeat data into ES.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 20, 2017, 8:31pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/10 "2017-04-20T20:31:52Z")
I will change output to and then run command again
```auto
output {
elasticsearch {
hosts => ["http://192.168.1.35:9200"]
action => "index"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
user => "logstash_user"
password => " *********"
}
stdout { codec => rubydebug }
}
```
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 20, 2017, 9:03pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/11 "2017-04-20T21:03:07Z")
I'm seeing the events in stdout still but not through Kibana.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 20, 2017, 9:15pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/12 "2017-04-20T21:15:44Z")
Is there anything in the debug log related to the ES output? How about in the Elasticsearch logs? Does this `logstash_user` have the appropriate roles to allow it to write to `winlogbeat-*`?
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 24, 2017, 10:28pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/13 "2017-04-24T22:28:22Z")
Within Kibana, I had configured the logstash\_writer role with the logstash-\* index, which if I am not mistaken should be winlogbeat-\* with write, delete and create\_index privileges. Once I made this change it seemed like my cluster came screaching to a halt, so from devtools I ran DELETE \_all to clear everything out. Now I'm at the point of creating a new index, which when I enter "winlogbeat-\*" to create the index Kibana doesn't find anything, so winlogbeat logs do not look like they are making it there.
Below is from the ES log...
[2017-04-24T10:52:57,034][INFO][o.e.l.LicenseService] [TbK7VUK] license [b3033b96-6eae-4a0f-b5c2-d679c132dc16] mode [gold] - valid
[2017-04-24T10:52:57,050][INFO][o.e.g.GatewayService] [TbK7VUK] recovered [949] indices into cluster\_state
[2017-04-24T10:53:29,269][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [TbK7VUK] failed to put mappings on indices [[[.security\_audit\_log-2017.04.24/hPBp6lvaQyOOGdUZHrtwpQ]]], type [event]
org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-mapping) within 30s
at org.elasticsearch.cluster.service.ClusterService.lambda$onTimeout$4(ClusterService.java:497) ~[elasticsearch-5.3.0.jar:5.3.0]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:544) [elasticsearch-5.3.0.jar:5.3.0]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0\_111]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0\_111]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0\_111]
[2017-04-24T10:53:41,519][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [TbK7VUK] failed to put mappings on indices [[[winlogbeat-2017.04.24/whgl8QHXQO6\_bnFKLWJH5Q]]], type [wineventlog]
org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-mapping) within 30s
at org.elasticsearch.cluster.service.ClusterService.lambda$onTimeout$4(ClusterService.java:497) ~[elasticsearch-5.3.0.jar:5.3.0]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:544) [elasticsearch-5.3.0.jar:5.3.0]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0\_111]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0\_111]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0\_111]
[2017-04-24T10:54:12,864][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [TbK7VUK] failed to put mappings on indices [[[winlogbeat-2017.04.24/whgl8QHXQO6\_bnFKLWJH5Q]]], type [wineventlog]
org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-mapping) within 30s
at org.elasticsearch.cluster.service.ClusterService.lambda$onTimeout$4(ClusterService.java:497) ~[elasticsearch-5.3.0.jar:5.3.0]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:544) [elasticsearch-5.3.0.jar:5.3.0]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0\_111]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0\_111]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0\_111]
[2017-04-24T10:55:15,552][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [TbK7VUK] failed to put mappings on indices [[[winlogbeat-2017.04.24/whgl8QHXQO6\_bnFKLWJH5Q]]], type [wineventlog]
org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to process cluster event (put-mapping) within 30s
at org.elasticsearch.cluster.service.ClusterService.lambda$onTimeout$4(ClusterService.java:497) ~[elasticsearch-5.3.0.jar:5.3.0]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:544) [elasticsearch-5.3.0.jar:5.3.0]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0\_111]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0\_111]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0\_111]
[2017-04-24T10:55:46,881][DEBUG][o.e.a.a.i.m.p.TransportPutMappingAction] [TbK7VUK] failed to put mappings on indices [[[winlogbeat-2017.04.24/whgl8QHXQO6\_bnFKLWJH5Q]]], type [wineventlog]
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 24, 2017, 11:08pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/14 "2017-04-24T23:08:08Z")
When Winlogbeat is pointed directly to ES it needs these privs for `winlogbeat-*`: `manage_index_templates`, `monitor`, `write` and `create_index`. But since you are going to through Logstash you will be managing the installation of the index templates yourself so you can drop that privilege.
I think these two commands would be enough to create a user and role for writing to `winlogbeat-*`.
```auto
POST _xpack/security/role/winlogbeat_writer
{
"cluster": ["monitor"],
"indices": [
{
"names": ["winlogbeat-*"],
"privileges": ["write","create_index"]
}
]
}
```
```auto
POST /_xpack/security/user/winlogbeat_user
{
"password" : "changeme",
"roles" : ["winlogbeat_writer"],
"full_name" : "Winlogbeat User"
}
```
Then you can update the Logstash config to use this user when outputting Winlogbeat data.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 24, 2017, 11:24pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/15 "2017-04-24T23:24:59Z")
When you ran `DELETE _all` you probably deleted more than you intended to. This would have deleted system indices like `.kibana` which hold Kibana's internal data. So you might be in a bad state now.
To summarize the setup steps, once you have ES, Kibana, and X-Pack installed/working:
- I would add a new winlogbeat user and role (as described in my last post). (additional info [here](https://www.elastic.co/guide/en/x-pack/5.3/installing-xpack.html))
- [Manually install](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html#load-template-manually) the index template for `winlogbeat-*`. The index template is provided as a file in the Winlogbeat download. You can install it from Windows using the command listed in the docs or you can copy it over to a Linux machine and use a curl command like `curl -XPUT -u "user:password" http://es:9200/_template/winlogbeat -d@winlobeat.template.json`. Use an account that has privs to install index templates.
- [Load the sample dashboard](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-sample-dashboards.html) for Winlogbeat. Again, use a superuser account.
- Configure Logstash with an elasticsearch output that uses the new winlogbeat user.
- Lastly, start shipping Winlogbeat data to Logstash.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 25, 2017, 9:16pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/16 "2017-04-25T21:16:10Z")
Andrew...Thank you very much for helping me out here. I had no problem getting winlogbeat to send to ES directly and view data using kibana, even after installing x-pack. I went back to install logstash after all of that and that seems to be where I ran into problems. I am trying to keep x-pack out of the scenario for now to KISS (Keep It Simple Stupid), so using Windows 2012 R2, I have installed ES as service, installed logstash as service and installed kibana as service. I am able to receive winlogbeat data from clients when shipping directly to elasticsearch in winlogbeat config, but unable to receive data from logstash...so minus the x-pack plugin and users you mention above my system should be exactly what you last mentioned. I think the problem is either in my config or the service I created using nssm (Non-Sucking Service Manager)...(see below)
```auto
input {
beats {
port => 5044
}
}
#
#filter {}
#
output {
elasticsearch {
hosts => ["192.168.1.35:9200"] }
}
```
--nssm service configuration--
Service Name: logstash
Path: C:\ELK\logstash-5.3.0\bin\logstash.bat
Startup Directory: C\ELK\logstash-5.3.0\bin
Arguments: -f .\logstash.conf
Dependencies: elasticsearch-service-x64
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 25, 2017, 9:37pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/17 "2017-04-25T21:37:16Z")
OK so I was expecting the data to showup on ES with the winlogbeat index, but just found that it is showing up as "logstash-\*" index, but at least I'm getting the data now
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 25, 2017, 9:37pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/18 "2017-04-25T21:37:26Z")
Crawl, walk, run... starting simple is a good approach. In the config given above you have not specified some important parameters for the elasticsearch output. Checkout this [documentation](https://www.elastic.co/guide/en/beats/libbeat/5.3/logstash-installation.html#logstash-setup) that shows a barebones Logstash setup for Beats.
With the config you have, data is going to be written to `logstash-YYYY.MM.DD` indices because of the [default index](https://www.elastic.co/guide/en/logstash/5.3/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index) value for LS output.
If you run a command like `curl http://elasticsearch:9200/_cat/indices?v` (or just open that in a browser or use the kibana dev console) you will see what indices exist and how many documents they have. Probably you will see logstash-2017.04.XX indices when some non-zero `docs.counts` values.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 25, 2017, 9:38pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/19 "2017-04-25T21:38:42Z")
P.S. Make sure you manually installed the index template from Winlogbeat before streaming data to `winlogbeat-*`.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 25, 2017, 9:46pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/20 "2017-04-25T21:46:45Z")
Will I need to manually install the index template if the index is already there being used from other clients sending data directly to ES using that index?
[Next page](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636.md?page=2)