# Winlogbeat can't setup dashboard

**URL:** <https://discuss.elastic.co/t/winlogbeat-cant-setup-dashboard/210324>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 3, 2019, 10:17am UTC](https://discuss.elastic.co/t/winlogbeat-cant-setup-dashboard/210324 "2019-12-03T10:17:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![onelaseth](https://avatars.discourse-cdn.com/v4/letter/o/e68b1a/32.png) [@onelaseth](https://discuss.elastic.co/u/onelaseth)\
**Post date:** [December 3, 2019, 10:17am UTC](https://discuss.elastic.co/t/winlogbeat-cant-setup-dashboard/210324/1 "2019-12-03T10:17:47Z")

</div>

Hi,

I am trying to get winlogbeat to work on a windows server. My config is:

> ###################### Winlogbeat Configuration Example ########################
> 
> # This file is an example configuration file highlighting only the most common
> 
> # options. The winlogbeat.reference.yml file from the same directory contains
> 
> # all the supported options with more comments. You can use it as a reference.
> 
> # 
> 
> # You can find the full configuration reference here:
> 
> # [Winlogbeat Reference | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/index.html)
> 
> #======================= Winlogbeat specific options ===========================
> 
> # event\_logs specifies a list of event logs to monitor as well as any
> 
> # accompanying options. The YAML data type of event\_logs is a list of
> 
> # dictionaries.
> 
> # 
> 
> # The supported keys are name (required), tags, fields, fields\_under\_root,
> 
> # forwarded, ignore\_older, level, event\_id, provider, and include\_xml. Please
> 
> # visit the documentation for the complete details of each option.
> 
> # [Configure Winlogbeat | Winlogbeat Reference [8.11] | Elastic](https://go.es.io/WinlogbeatConfig)
> 
> winlogbeat.event\_logs:
> 
> - name: Application  
> ignore\_older: 72h
> 
> - name: System
> 
> - name: Security  
> processors:
> 
> - name: Microsoft-Windows-Sysmon/Operational  
> processors:
> 
> #==================== Elasticsearch template settings ==========================
> 
> setup.template.settings:  
> index.number\_of\_shards: 1  
> #index.codec: best\_compression  
> #\_source.enabled: false
> 
> #================================ General =====================================
> 
> # The name of the shipper that publishes the network data. It can be used to group
> 
> # all the transactions sent by a single shipper in the web interface.
> 
> #name:
> 
> # The tags of the shipper are included in their own field with each
> 
> # transaction published.
> 
> #tags: ["service-X", "web-tier"]
> 
> # Optional fields that you can specify to add additional information to the
> 
> # output.
> 
> #fields:
> 
> # env: staging
> 
> #============================== Dashboards =====================================
> 
> # These settings control loading the sample dashboards to the Kibana index. Loading
> 
> # the dashboards is disabled by default and can be enabled either by setting the
> 
> # options here or by using the `setup` command.
> 
> #setup.dashboards.enabled: false
> 
> # The URL from where to download the dashboards archive. By default this URL
> 
> # has a value which is computed based on the Beat name and version. For released
> 
> # versions, this URL points to the dashboard archive on the [artifacts.elastic.co](http://artifacts.elastic.co)
> 
> # website.
> 
> #setup.dashboards.url:
> 
> #============================== Kibana =====================================
> 
> # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
> 
> # This requires a Kibana endpoint configuration.
> 
> setup.kibana.host: "192.168.10.15:5601"
> 
> # Kibana Host
> 
> # Scheme and port can be left out and will be set to the default (http and 5601)
> 
> # In case you specify and additional path, the scheme is required: [http://localhost:5601/path](http://localhost:5601/path)
> 
> # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
> 
> # Kibana Space ID
> 
> # ID of the Kibana Space into which the dashboards should be loaded. By default,
> 
> # the Default Space will be used.
> 
> #space.id:
> 
> #============================= Elastic Cloud ==================================
> 
> # These settings simplify using Winlogbeat with the Elastic Cloud ([https://cloud.elastic.co/](https://cloud.elastic.co/)).
> 
> # The cloud.id setting overwrites the `output.elasticsearch.hosts` and
> 
> # `setup.kibana.host` options.
> 
> # You can find the `cloud.id` in the Elastic Cloud web UI.
> 
> #cloud.id:
> 
> # The cloud.auth setting overwrites the `output.elasticsearch.username` and
> 
> # `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
> 
> #cloud.auth:
> 
> #================================ Outputs =====================================
> 
> # Configure what output to use when sending the data collected by the beat.
> 
> #-------------------------- Elasticsearch output ------------------------------  
> output.elasticsearch:
> 
> # Array of hosts to connect to.
> 
> hosts: ["192.168.10.15:9200"]
> 
> # Optional protocol and basic auth credentials.
> 
> #protocol: "https"  
> #username: "elastic"  
> #password: "changeme"
> 
> #----------------------------- Logstash output --------------------------------  
> #output.logstash:
> 
> # The Logstash hosts
> 
> #hosts: ["192.168.10.15:5044"]
> 
> # Optional SSL. By default is off.
> 
> # List of root certificates for HTTPS server verifications
> 
> #ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]
> 
> # Certificate for SSL client authentication
> 
> #ssl.certificate: "/etc/pki/client/cert.pem"
> 
> # Client Certificate Key
> 
> #ssl.key: "/etc/pki/client/cert.key"
> 
> #================================ Processors =====================================
> 
> # Configure processors to enhance or manipulate events generated by the beat.
> 
> processors:
> 
> - add\_host\_metadata: ~
> - add\_cloud\_metadata: ~
> 
> #================================ Logging =====================================
> 
> # Sets log level. The default log level is info.
> 
> # Available log levels are: error, warning, info, debug
> 
> #logging.level: debug
> 
> # At debug level, you can selectively enable logging only for some components.
> 
> # To enable all selectors use ["\*"]. Examples of other selectors are "beat",
> 
> # "publish", "service".
> 
> #logging.selectors: ["\*"]
> 
> #============================== X-Pack Monitoring ===============================
> 
> # winlogbeat can export internal metrics to a central Elasticsearch monitoring
> 
> # cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
> 
> # reporting is disabled by default.
> 
> # Set to true to enable the monitoring reporter.
> 
> #monitoring.enabled: false
> 
> # Sets the UUID of the Elasticsearch cluster under which monitoring data for this
> 
> # Winlogbeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
> 
> # is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
> 
> #monitoring.cluster\_uuid:
> 
> # Uncomment to send the metrics to Elasticsearch. Most settings from the
> 
> # Elasticsearch output are accepted here as well.
> 
> # Note that the settings should point to your Elasticsearch _monitoring_ cluster.
> 
> # Any setting that is not set is automatically inherited from the Elasticsearch
> 
> # output configuration, so if you have the Elasticsearch output configured such
> 
> # that it is pointing to your Elasticsearch monitoring cluster, you can simply
> 
> # uncomment the following line.
> 
> #monitoring.elasticsearch:
> 
> #================================= Migration ==================================
> 
> # This allows to enable 6.7 migration aliases
> 
> #migration.6\_to\_7.enabled: true

When i do a config check, it gives zero errors. After that i want to setup a dashboard for kibana with the following command: .\winlogbeat.exe setup --dashboards  
This is the result:

> Loading dashboards (Kibana must be running and reachable)  
> Exiting: error connecting to Kibana: fail to get the Kibana version: fail to unmarshal the response from GET [http://192.168.10.15:5601/api/status](http://192.168.10.15:5601/api/status). Response: {"name":"ubuntu","version":"5.6.16","buildNum":15690,"buildSha":"e4c8b3e8245cbf4f81d0d31476c61125e366c2d9","uuid":"dcef52f0-2c75-474e-9d40-1791f28cf2d4","status":{"overall":{"state":"green","title":"Green","nickname":"Looking good","icon":"success","... (truncated). Kibana status api returns: json: cannot unmarshal string into Go struct field kibanaVersionResponse.version of type struct { Number string "json:"number""; Snapshot bool "json:"build\_snapshot"" }

I don't know why i get this error, since kibana is accessable from other machines in the network.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2019, 10:25am UTC](https://discuss.elastic.co/t/winlogbeat-cant-setup-dashboard/210324/2 "2019-12-31T10:25:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.