# Winlogbeat Failed to publish events caused by: lumberjack protocol error

**URL:** <https://discuss.elastic.co/t/winlogbeat-failed-to-publish-events-caused-by-lumberjack-protocol-error/238469>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [June 24, 2020, 12:58pm UTC](https://discuss.elastic.co/t/winlogbeat-failed-to-publish-events-caused-by-lumberjack-protocol-error/238469 "2020-06-24T12:58:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Phillip](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@Phillip](https://discuss.elastic.co/u/Phillip)\
**Post date:** [June 24, 2020, 12:58pm UTC](https://discuss.elastic.co/t/winlogbeat-failed-to-publish-events-caused-by-lumberjack-protocol-error/238469/1 "2020-06-24T12:58:46Z")

</div>

Hi,

I wanted to install winloagbeat on an Windows Server to get his informations. I forwarded the logs to lagstash, but after starting the service, the following problems are appearing:

```auto
2020-06-24T14:41:32.573+0200	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: lumberjack protocol error
2020-06-24T14:41:32.634+0200	ERROR	[logstash]	logstash/async.go:280	Failed to publish events caused by: client is not connected
2020-06-24T14:41:34.575+0200	ERROR	[publisher_pipeline_output]	pipeline/output.go:181	failed to publish events: client is not connected

```

I configured the ELK Stack on a CentOS 7, everything works fine, i get already logs from filebeat from Linux Servers.

I also can connect to the ELK Server from my Windows Client

```auto
RemotePort : 5044
InterfaceAlias : Ethernet0
TcpTestSucceeded : True

```

In the winlogbeat.yml i commented out the elastic output and configured the logstash output as follows:

```auto
# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["XXX.XXX.XXX:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  # ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  # ssl.key: "/etc/pki/client/cert.key"

```

Also the ELK-Server is listening on port 5044

```auto
tcp6 0 0 :::5044 :::* LISTEN 2619/java

```

I also tried the new .msi installer, same problem. Also if i using the FQDN instead of the ip the problems are appearing.

Does anyone have a idea why its not working with winlogbeat?

Thanks!

---

<div class="post-metadata">

**Author:** ![Phillip](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@Phillip](https://discuss.elastic.co/u/Phillip)\
**Post date:** [June 30, 2020, 11:14am UTC](https://discuss.elastic.co/t/winlogbeat-failed-to-publish-events-caused-by-lumberjack-protocol-error/238469/2 "2020-06-30T11:14:20Z")

</div>

Hello again,

So i could configure winlogbeat now. I also can see, that logs came to elasticsearch:

````auto
{
    "query":{
      "match_all":{}
    }
}```

```{
  "took" : 10,
  "timed_out" : false,
  "_shards" : {
    "total" : 190,
    "successful" : 190,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 43593,
    "max_score" : 1.0,
    "hits" : [

````

But when i search for the logs in Kibana discover, nothin is appearing? I also created an index for winlogbeats.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2020, 1:14pm UTC](https://discuss.elastic.co/t/winlogbeat-failed-to-publish-events-caused-by-lumberjack-protocol-error/238469/3 "2020-07-28T13:14:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.