# Unable to get winlogbeat to send to logstash
**URL:** https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636
**Category:** Beats
**Tags:** winlogbeat
**Created:** [April 17, 2017, 10:31pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636 "2017-04-17T22:31:00Z")
**Posts on this page:** 10
**Page:** 2
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 25, 2017, 9:52pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/21 "2017-04-25T21:52:57Z")
If any Winlogbeat is sending data directly to ES then it will have automatically installed the index template for you. When going though Logstash, Winlogbeat isn't able to directly communicate to ES so you have to do it yourself (we might improve this in the future by proxying the template through LS).
You can check that the winlogbeat template is installed with this command which will return the contents of the templates matching the name "winlogbeat\*".
`GET _template/winlogbeat*` (that's the kibana dev console syntax)
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 25, 2017, 9:58pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/22 "2017-04-25T21:58:42Z")
from powershell I ran command: .\bin\logstash-plugin list
and it showed logstash-input-beats within the list. Since all versions of the stack are the same I am assuming it is also the same (version 5.3.0)
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 26, 2017, 2:10pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/23 "2017-04-26T14:10:44Z")
To show plugin versions in Logstash you need to add `--version` ([reference](https://www.elastic.co/guide/en/logstash/current/working-with-plugins.html)). But the plugin version it ships with should be fine.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 26, 2017, 6:47pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/24 "2017-04-26T18:47:41Z")
ran command: .\bin\logstash-plugin list --verbose
Result: logstash-input-beats (3.1.12)
ran command: .\bin\logstash-plugin remove logstash-input-beats
Result: Successfully removed logstash-input-beats
Downloaded:
> **[logstash-plugins/logstash-input-beats](https://github.com/logstash-plugins/logstash-input-beats)**
>
> Contribute to logstash-input-beats development by creating an account on GitHub.
Copied downloaded file "logstash-input-beats-master.zip" to C:\ELK\logstash-5.3.0
ran command: .\bin\logstash-plugin install --no-verify
Result: Error Bundler::Install Error...Make sure that 'gem install logstash-core-event-java -v '5.3.0' succeeds before bundling.
I found the bundler-1.9.10 folder and ran .\bundle install from powershell and it asks how I want to open this file, I would assume jruby, but would definitely appreciate any assistance getting past this so I'm not spinning my wheels any longer.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 26, 2017, 7:07pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/25 "2017-04-26T19:07:57Z")
The beats plugin version that LS ships with is fine. So I wouldn't try to update it. Just use the stock download.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 26, 2017, 8:50pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/26 "2017-04-26T20:50:31Z")
I had already removed it, since the version showed up 3.1.12...I was under the impression that all of the versions should match and it needed to be removed and the new one installed.
...So now what do you recommend?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 26, 2017, 9:36pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/27 "2017-04-26T21:36:36Z")
Delete the logstash directory and replace it with a clean copy from the 5.3 zip you download.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 26, 2017, 9:49pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/28 "2017-04-26T21:49:47Z")
OK I think I'm back on track..clean copy back in place and logstash-input-beats (3.1.12) is showing up again.
---
### Author:  [@Greenie](https://discuss.elastic.co/u/Greenie)
#### Post date: [April 27, 2017, 6:33pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/29 "2017-04-27T18:33:27Z")
Andrew -
I want to thank you for helping me stumble through this. I found that I was missing one quote in the logstash config that was not allowing the winlogbeat data to get to elasticsearch...pretty frustrating, but thanks again for sticking with me on this. I think I was making it more complicated than it needed to be. Cheerz!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 25, 2017, 6:45pm UTC](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636/30 "2017-05-25T18:45:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
[Previous page](https://discuss.elastic.co/t/unable-to-get-winlogbeat-to-send-to-logstash/82636.md?page=1)