Winlogbeat.exe - Failed: 32bit on 64bit system

Elastic Stack Beats
1

Hello,
I downloaded winlogbeat-7.15.1-windows-x86 and installed it using "uninstall-service-winlogbeat.ps1" according to the documentation. (WindowsServer2019)

  •  PS C:\program files\Winlogbeat> .\install-service-winlogbeat.ps1

 Security warning
 Run only scripts ... message. 
 Do you want to run C:\program files\Winlogbeat\install-service-winlogbeat.ps1?
 [D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): r

 Status   Name               DisplayName
 ------   ----               -----------
 Stopped  winlogbeat         winlogbeat

The service cannot be started:

  •   PS C:\program files\Winlogbeat> start-service winlogbeat
  start-service : The service 'winlogbeat (winlogbeat)' cannot be started due to the following error: Service cannot be started
  winlogbeat on computer '.' fails to start.
  In line:1 character:1
  + start-service winlogbeat
      + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service],
 ServiceCommandException
      + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

  • When I start the service via services.msc, I get the following error:

  •  Error 1053 - "The service did not respond to the startup or control request in time."
 SSL is not used.

  • And when running the ".\winlogbeat.exe test config -c .\winlogbeat.yml -e", the message comes:

  •  PS C:\program files\Winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e
 Initialization failed: Attempting to run 32bit binary on 64bit system.

What did I do wrong here.

Regards.

2

Looks like you download the 32-bit binary. The file name for 64-bit is winlogbeat-7.15.1-windows-x86_64.zip.

1 Like
3

It was the browser. Here you could choose the platform, but that did not change the download file.

With a current browser the download worked correctly.

Thank you.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.