# Unable to send winlogbeat data to logstash
**URL:** https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404
**Category:** Logstash
**Created:** [August 7, 2018, 10:07pm UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404 "2018-08-07T22:07:45Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@ravikt](https://discuss.elastic.co/u/ravikt)
#### Post date: [August 7, 2018, 10:07pm UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/1 "2018-08-07T22:07:45Z")
I have
- Both metricbeat and winlogbeat agents installed on same AWS EC2 windows instance. I am trying to push the data to logstash. Logstash is just processing metricbeat data but not for winlogbeat.
I am using metricbeat v6.3.1 and winlogbeat 6.3.2
Error from logstash:
[WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the
pipeline did not handle the exception
Here is the configuration for **metricbeat** :
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
metricsets: ["cpu"]
enabled: true
period: 10s
processes: ['.\*']
#================================ Outputs =====================================
# Configure what output to use when sending the data collected by the beat.
#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["127.0.0.1:5044"]
Configuration for **winlogbeat** :
#======================= Winlogbeat specific options ==========================
winlogbeat.event\_logs:
- name: Application
ignore\_older: 72h
- name: Security
- name: System
#================================ Outputs =====================================
# Configure what output to use when sending the data collected by the beat.
#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["127.0.0.1:5044"]
**Configuration for Logstash** :
input {
beats {
port =\> 5044
}
}
output {
amazon\_es {
hosts =\> "[search-myelasticsearch-qynnaupascgdhsm.us-east-1.es.amazonaws.com](http://search-myelasticsearch-qynnaupascgdhsm.us-east-1.es.amazonaws.com)"
region =\> "us-east-1"
aws\_access\_key\_id =\> ''
aws\_secret\_access\_key =\> ''
index =\> "logs-%{+YYYY.MM.dd}"
}
}
Please advise what I should be doing to fix this.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 8, 2018, 6:00am UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/2 "2018-08-08T06:00:01Z")
> Both metricbeat and winlogbeat agents installed on same AWS EC2 windows instance. I am trying to push the data to logstash. Logstash is just processing metricbeat data but not for winlogbeat.
Does the Winlogbeat logfile contain anything interesting? If not, try raising its loglevel.
> Error from logstash:
> [WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the
> pipeline did not handle the exception
That's just a warning that hardly is relevant in this case. Is there anything else in the log?
---
### Author:  [@ravikt](https://discuss.elastic.co/u/ravikt)
#### Post date: [August 9, 2018, 3:11am UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/3 "2018-08-09T03:11:31Z")
I tried sending winlogbeat data to a different logstash instance, it worked. It looks like it is not letting me send different beat agents data to same logstash instance.
---
### Author:  [@ravikt](https://discuss.elastic.co/u/ravikt)
#### Post date: [August 9, 2018, 3:16am UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/4 "2018-08-09T03:16:46Z")
Here are the logs from /var/log/logstash/ when I tried to send data for both winlogbeat and metricbeat to same logstash instance.
"
[2018-08-08T00:00:22,606][INFO][org.logstash.beats.Server] Starting server on port: 5044
[2018-08-08T00:00:28,825][ERROR][logstash.pipeline] A plugin had an unrecoverable error. Will restart this plugin.
Pipeline\_id:main
Plugin: \"wineventlog", port=\>5044, id=\>"12deb3eecd08e0f810ba7fdd1e851bab70a79c84305f1f7a691d32d22a866675", enable\_metric=\>true, codec=\>\
"plain\_f59a724b-9b39-441c-961a-9419fff46c3a", enable\_metric=\>true, charset=\>"UTF-8"\>, host=\>"0.0.0.0", ssl=\>false, add\_hostname=\>true, ssl\_verify\_mode=\>"none", ssl\_peer\_metadata=\>false, include\_cod
ec\_tag=\>true, ssl\_handshake\_timeout=\>10000, tls\_min\_version=\>1, tls\_max\_version=\>1.2, cipher\_suites=\>["TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_
ECDSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256", "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384", "TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256",
"TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256"], client\_inactivity\_timeout=\>60, executor\_threads=\>2\>
Error: Address already in use
Exception: Java::JavaNet::BindException
Stack: sun.nio.ch.Net.bind0(Native Method)
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:433)
sun.nio.ch.Net.bind(sun/nio/ch/Net.java:425)
sun.nio.ch.ServerSocketChannelImpl.bind(sun/nio/ch/ServerSocketChannelImpl.java:223)
io.netty.channel.socket.nio.NioServerSocketChannel.doBind(io/netty/channel/socket/nio/NioServerSocketChannel.java:128)
io.netty.channel.AbstractChannel$AbstractUnsafe.bind(io/netty/channel/AbstractChannel.java:558)
io.netty.channel.DefaultChannelPipeline$HeadContext.bind(io/netty/channel/DefaultChannelPipeline.java:1283)
io.netty.channel.AbstractChannelHandlerContext.invokeBind(io/netty/channel/AbstractChannelHandlerContext.java:501)
io.netty.channel.AbstractChannelHandlerContext.bind(io/netty/channel/AbstractChannelHandlerContext.java:486)
io.netty.channel.DefaultChannelPipeline.bind(io/netty/channel/DefaultChannelPipeline.java:989)
io.netty.channel.AbstractChannel.bind(io/netty/channel/AbstractChannel.java:254)
io.netty.bootstrap.AbstractBootstrap$2.run(io/netty/bootstrap/AbstractBootstrap.java:364)
io.netty.util.concurrent.AbstractEventExecutor.safeExecute(io/netty/util/concurrent/AbstractEventExecutor.java:163)
io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(io/netty/util/concurrent/SingleThreadEventExecutor.java:403)
io.netty.channel.nio.NioEventLoop.run(io/netty/channel/nio/NioEventLoop.java:463)
io.netty.util.concurrent.SingleThreadEventExecutor$5.run(io/netty/util/concurrent/SingleThreadEventExecutor.java:858)
io.netty.util.concurrent.FastThreadLocalRunnable.run(io/netty/util/concurrent/FastThreadLocalRunnable.java:30)
java.lang.Thread.run(java/lang/Thread.java:748)
"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 9, 2018, 7:39am UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/5 "2018-08-09T07:39:37Z")
You can't have two beats inputs listening on the same port (and there's no need for that either unless you for some reason must process the events in two different Logstash pipelines).
---
### Author:  [@ravikt](https://discuss.elastic.co/u/ravikt)
#### Post date: [August 10, 2018, 9:47am UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/6 "2018-08-10T09:47:32Z")
Thank you.
Do you mean that we can send data from same source for 2 different beats agents on different ports to same logstash instance?
If above is true, how do we then achieve this?
Config should be something like this?
input {
beats {
port =\> 5044
}
}
output {
amazon\_es {
hosts =\> "[search-myelasticsearch-qynnaupascgdhsm.us-east-1.es.amazonaws.com](http://search-myelasticsearch-qynnaupascgdhsm.us-east-1.es.amazonaws.com)"
region =\> "us-east-1"
aws\_access\_key\_id =\> ''
aws\_secret\_access\_key =\> ''
index =\> "metriclogs-%{+YYYY.MM.dd}"
}
}
input {
beats {
port =\> 5043
}
}
output {
amazon\_es {
hosts =\> "[search-myelasticsearch-qynnaupascgdhsm.us-east-1.es.amazonaws.com](http://search-myelasticsearch-qynnaupascgdhsm.us-east-1.es.amazonaws.com)"
region =\> "us-east-1"
aws\_access\_key\_id =\> ''
aws\_secret\_access\_key =\> ''
index =\> "wineventlogs-%{+YYYY.MM.dd}"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2018, 10:05am UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/7 "2018-08-10T10:05:10Z")
> Do you mean that we can send data from same source for 2 different beats agents on different ports to same logstash instance?
Yes, but I see no reason to use different ports.
This thread is very similar to a lengthy thread from yesterday and I don't want to repeat myself: [How to split linux and windows data in two different indexes](https://discuss.elastic.co/t/how-to-split-linux-and-windows-data-in-two-different-indexes/143697)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2018, 10:05am UTC](https://discuss.elastic.co/t/unable-to-send-winlogbeat-data-to-logstash/143404/8 "2018-09-07T10:05:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.