# Winlogbeat error during setup **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [August 6, 2020, 8:27pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093 "2020-08-06T20:27:18Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![JohnLyman](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@JohnLyman](https://discuss.elastic.co/u/JohnLyman)\ **Post date:** [August 6, 2020, 8:27pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/1 "2020-08-06T20:27:18Z")
When running `.\winlogbeat-7.8.1-windows-x86_64\winlogbeat.exe export index-pattern` I'm getting the following error: ```auto Error generating Index Pattern: field is duplicated. ``` I verified that this error goes all the way back to 7.4.0 (7.3.2 works). Is there a work-around? I'm guessing I can remove one of the entries from fields.yml, but I'm not sure which. ---
**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\ **Post date:** [August 10, 2020, 4:20pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/2 "2020-08-10T16:20:17Z")
@JohnLyman, I have downloaded the 7.8.1 and ran the same cmd line but I was able to generate the index pattern, are there any previous steps you have taken before launching this cmd? @adrisr are you familiar with an issue as this? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [August 10, 2020, 5:36pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/3 "2020-08-10T17:36:17Z")
This is really weird because as far as I could test, Beats use the fields built into the binary, not the _fields.yml_ file. I don't have this problem neither with the default nor with the OSS 7.8.1 distributions just downloaded from our page. Where did you get that binary from? Can you check the SHA256 sum of the winlogbeat.exe? I tested with: ```auto 51b16d6188ece0890e2481c969c94d666230a2a6d563e53ce96b18a8e7f6f61f winlogbeat.exe 9043034f59b81fdf42381172b68f8b92ac8ac3ee3c50ec8d34dec2413f331adb (oss) winlogbeat.exe ``` Also share your config, although I don't think config influences this. ---
**Author:** ![JohnLyman](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@JohnLyman](https://discuss.elastic.co/u/JohnLyman)\ **Post date:** [August 10, 2020, 5:36pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/4 "2020-08-10T17:36:35Z")
No, I just downloaded the zip and ran that command. I did run with `-c beats.yml`. Here's what that looks lie: ```auto migration.6_to_7.enabled: true setup.ilm.enabled: false setup.kibana.host: "https://kibana:5601" setup.kibana.username: "elastic" setup.kibana.password: "REDACTED" setup.kibana.ssl.enabled: true output.elasticsearch.hosts: "https://elastic" output.elasticsearch.username: "elastic" output.elasticsearch.password: "REDACTED" output.elasticsearch.ssl.enabled: true output.elasticsearch.enabled: true logging.level: debug winlogbeat: event_logs: - name: Application - name: Security - name: System ``` Maybe `migration.6_to_7.enabled: true` is the key. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [August 10, 2020, 5:38pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/5 "2020-08-10T17:38:43Z")
Right, I can reproduce with: > winlogbeat export index-pattern -E migration.6\_to\_7.enabled=true I will create an issue. ---
**Author:** ![JohnLyman](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@JohnLyman](https://discuss.elastic.co/u/JohnLyman)\ **Post date:** [August 10, 2020, 5:40pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/6 "2020-08-10T17:40:27Z")
> [@JohnLyman](#): > > Is there a work-around? I'm guessing I can remove one of the entries from fields.yml, but I'm not sure which. What about this? ---
**Author:** ![JohnLyman](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@JohnLyman](https://discuss.elastic.co/u/JohnLyman)\ **Post date:** [August 11, 2020, 7:11pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/7 "2020-08-11T19:11:41Z")
@adrisr ^ Also, is there a public github issue I can follow? ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [August 12, 2020, 8:55am UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/8 "2020-08-12T08:55:09Z")
Yes, here's the issue: [https://github.com/elastic/beats/issues/20521](https://github.com/elastic/beats/issues/20521) And the fix PR: [https://github.com/elastic/beats/pull/20540](https://github.com/elastic/beats/pull/20540) Unfortunately I can't think of a quick workaround for you, other than building a new Winlogbeat binary with the change to `winlogbeat/_meta/fields.common.yml` from the above PR. ---
**Author:** ![JohnLyman](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@JohnLyman](https://discuss.elastic.co/u/JohnLyman)\ **Post date:** [August 12, 2020, 11:47am UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/9 "2020-08-12T11:47:05Z")
Thanks @adrisr ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 9, 2020, 1:47pm UTC](https://discuss.elastic.co/t/winlogbeat-error-during-setup/244093/10 "2020-09-09T13:47:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.