# Winlogbeat - Cannot start
**URL:** https://discuss.elastic.co/t/winlogbeat-cannot-start/202692
**Category:** Beats
**Tags:** winlogbeat
**Created:** [October 8, 2019, 2:48pm UTC](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692 "2019-10-08T14:48:09Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)
#### Post date: [October 8, 2019, 2:48pm UTC](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692/1 "2019-10-08T14:48:09Z")
Hello Folks,
I use SSL/TLS encryption, it works fine. I use keystore to access my password. When I launch winlogbeat from powershell, it fails, see error below.
However, if I make it run manually from PowerShell, I have no errors. I can see my logs on Kibana.
That is how I call my password.
```
output.elasticsearch:
protocol: "https"
username: "elastic"
password: "${ES_PWD}"
```
`.\winlogbeat.exe test config -c .\winlogbeat.yml -e` return Config OK.
**Error**
_Winlogbeat logs_
`2019-10-08T10:38:27.985-0400 ERROR instance/beat.go:878 Exiting: error initializing publisher: missing field accessing 'output.elasticsearch.password' (source:'C:\Program Files\winlogbeat\winlogbeat.yml')`
_PowerShell_
```
> start-service : Service 'winlogbeat (winlogbeat)' cannot be started due to the following error: Cannot open winlogbeat
> service on computer '.'.
> At line:1 char:1
> + start-service winlogbeat
> + ~~~~~~~~~~~~~~~~~~~~~~~~
> + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service],
> ServiceCommandException
> + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
```
I have read from a previous post to copy my keystore where my winlogbeat.yml file is, which I did, but it still fails. Any insight ?
## Links
> [@Using Keystores - not working (v6.6.0)](https://discuss.elastic.co/t/using-keystores-not-working-v6-6-0/167301):
>
> Hello, I'm trying to use a keystore value in my beat configuration and I can't seem to get it working... For example - I'm currently trying it with heartbeat. THIS WORKS - output.elasticsearch: password: "clear\_text\_pw" THIS DOES NOT WORK - output.elasticsearch: password: "${ES\_PWD}" When starting heartbeat the log gives me: Exiting: error initializing publisher: missing field accessing 'output.elasticsearch.password' (source:'/etc/heartbeat/heartbeat.yml') I definitely have the value…
---
### Author:  [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)
#### Post date: [October 8, 2019, 3:17pm UTC](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692/2 "2019-10-08T15:17:27Z")
If I do edit .yml to have clear password, it works fine. However, that's not what I am looking for.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [October 8, 2019, 3:23pm UTC](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692/3 "2019-10-08T15:23:33Z")
The Windows service for running Winlogbeat (or any Beat) is setting the `-path.data` flag to `C:\ProgramData\winlogbeat`. And I think this causes Winlogbeat to be looking in that directory for the keystore. Can you try moving your keystore there and starting the service.
There's an bug open but it hasn't been addressed: [https://github.com/elastic/beats/issues/12315](https://github.com/elastic/beats/issues/12315)
---
### Author:  [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)
#### Post date: [October 8, 2019, 3:29pm UTC](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692/4 "2019-10-08T15:29:06Z")
So I found the answer. It was the most ... easiest thing I haven't tested. I feel quit dumb haha.
**Solution**
`password: "${ES_PWD}" => password: "$ES_PWD"`
That was it. Moving keystore where winlogbeat.yml is changes nothing. Tried it. I really laughed at myself on that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 5, 2019, 3:29pm UTC](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692/5 "2019-11-05T15:29:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.