# Winlogbeat configuration issues

**URL:** <https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 8, 2017, 11:33am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360 "2017-02-08T11:33:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ArjunSISA](https://avatars.discourse-cdn.com/v4/letter/a/3e96dc/32.png) [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\
**Post date:** [February 8, 2017, 11:33am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360/1 "2017-02-08T11:33:24Z")

</div>

hi everyone,  
I have recently installed winlogbeat and configured it to forward the logs but i am unable to receive the logs. Can anyone help me with this?  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a93788b0dbb60c75907ac054095fe6c176d35833.png)

![](https://us1.discourse-cdn.com/elastic/original/2X/4/47ecfaf9478c0b56b9eef886dd2b5a1c594e6e76.jpg)

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 8, 2017, 12:42pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360/2 "2017-02-08T12:42:21Z")

</div>

Please, don't post screenshots of logs or configs!

Configuration format is yaml. And `#` is a comment. You have commented out the `output.logstash` line

---

<div class="post-metadata">

**Author:** ![ArjunSISA](https://avatars.discourse-cdn.com/v4/letter/a/3e96dc/32.png) [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\
**Post date:** [February 8, 2017, 1:31pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360/3 "2017-02-08T13:31:29Z")

</div>

```auto
#output.logstash:
  # The Logstash hosts
  -hosts: ["192.168.8.195:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 9, 2017, 1:58pm UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360/4 "2017-02-09T13:58:17Z")

</div>

did you already uncomment `output.logstash`?

It must say:

```auto
output.logstash:
  # The Logstash hosts
  - hosts: ["192.168.8.195:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

```

---

<div class="post-metadata">

**Author:** ![ArjunSISA](https://avatars.discourse-cdn.com/v4/letter/a/3e96dc/32.png) [@ArjunSISA](https://discuss.elastic.co/u/ArjunSISA)\
**Post date:** [February 10, 2017, 10:06am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360/5 "2017-02-10T10:06:52Z")

</div>

yes, @steffens done that. now receiving logs  
thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2017, 10:07am UTC](https://discuss.elastic.co/t/winlogbeat-configuration-issues/74360/6 "2017-03-10T10:07:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.