Winlogbeat default paths

The default Winlogbeat is ${path.home}/data, documented here

However, the default service installer install-service-winlogbeat.ps1 is programmed to set to "C:\ProgramData\winlogbeat" instead. Is this intentional, and why?

.\winlogbeat.exe keystore create creates the file ${path.home}/data/winlogbeat.keystore as documented here

In winlogbeat.yml i configure "${CLOUD_ID}" and cloud.auth: "${ES_PWD}"

Now when i go Start-Service Winlogbeat, tries to start, sets the to C:\programdata\winlogbeat\ and fails because it isn't seeing my keystore items and provides the error ERROR instance/beat.go:877 Exiting: error initializing publisher: missing required field accessing 'output.elasticsearch.hosts.

If i copy the winlogbeat.keystore to C:\programdata\winlogbeat\winlogbeat.keystore which is where the service has configured, it starts up as expected and the packets flow.

I don't like that i have to change default paths to make things work, however i suspect i am doing something wrong, so please help... Alternatively if this is not expected, ill raise a software bug/issue.

Looks like this is a known bug, and there is a workaround, however seems like a simple thing to fix in the source code.. Anyone know when this will work out of the box?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.