# Winlogbeat default paths
**URL:** https://discuss.elastic.co/t/winlogbeat-default-paths/198581
**Category:** Beats
**Created:** [September 8, 2019, 9:14pm UTC](https://discuss.elastic.co/t/winlogbeat-default-paths/198581 "2019-09-08T21:14:10Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@ajhstn](https://discuss.elastic.co/u/ajhstn)
#### Post date: [September 8, 2019, 9:14pm UTC](https://discuss.elastic.co/t/winlogbeat-default-paths/198581/1 "2019-09-08T21:14:10Z")
The default **Winlogbeat** `path.data` is `${path.home}/data`, documented here [https://www.elastic.co/guide/en/beats/winlogbeat/current/directory-layout.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/directory-layout.html).
However, the default service installer **install-service-winlogbeat.ps1** is programmed to set `-path.data` to `"C:\ProgramData\winlogbeat"` instead. Is this intentional, and why?
`.\winlogbeat.exe keystore create` creates the file `${path.home}/data/winlogbeat.keystore` as documented here [https://www.elastic.co/guide/en/beats/winlogbeat/current/keystore.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/keystore.html)
In **winlogbeat.yml** i configure `cloud.id: "${CLOUD_ID}"` and `cloud.auth: "${ES_PWD}"`
Now when i go `Start-Service Winlogbeat`, tries to start, sets the `path.data` to `C:\programdata\winlogbeat\` and fails because it isn't seeing my keystore items and provides the error `ERROR instance/beat.go:877 Exiting: error initializing publisher: missing required field accessing 'output.elasticsearch.hosts`.
If i copy the `winlogbeat.keystore` to `C:\programdata\winlogbeat\winlogbeat.keystore` which is where the service has `path.data` configured, it starts up as expected and the packets flow.
I don't like that i have to change default paths to make things work, however i suspect i am doing something wrong, so please help... Alternatively if this is not expected, ill raise a software bug/issue.
---
### Author:  [@ajhstn](https://discuss.elastic.co/u/ajhstn)
#### Post date: [September 8, 2019, 9:18pm UTC](https://discuss.elastic.co/t/winlogbeat-default-paths/198581/2 "2019-09-08T21:18:32Z")
Looks like this is a known bug [https://github.com/elastic/beats/issues/12315](https://github.com/elastic/beats/issues/12315), and there is a workaround, however seems like a simple thing to fix in the source code.. Anyone know when this will work out of the box?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 6, 2019, 11:18pm UTC](https://discuss.elastic.co/t/winlogbeat-default-paths/198581/3 "2019-10-06T23:18:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.