Winlogbeat failed to start

Hi there,
I'm trying to install winlogbeat 5.6.4 x64 on windows server 2012,but failed to start it,error as follows:

PS C:\winlogbeat-5.6.4> Start-Service -DisplayName “winlogbeat” -Verbose
VERBOSE: Performing the operation "Start-Service" on target "winlogbeat (winlogbeat)".
Start-Service : Service 'winlogbeat (winlogbeat)' cannot be started due to the following error: Cannot start service
winlogbeat on computer '.'.
At line:1 char:1

  • Start-Service -DisplayName “winlogbeat” -Verbose
  •   + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service],
      + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

I also tested yml file,and it's normal:

PS C:\winlogbeat-5.6.4> .\winlogbeat.exe -c .\winlogbeat.yml -configtest -e
2017/12/01 05:25:27.844099 beat.go:297: INFO Home path: [C:\winlogbeat-5.6.4] Config path: [C:\winlogbeat-5.6.4] Data pa
th: [C:\winlogbeat-5.6.4\data] Logs path: [C:\winlogbeat-5.6.4\logs]
2017/12/01 05:25:27.845095 beat.go:192: INFO Setup Beat: winlogbeat; Version: 5.6.4
2017/12/01 05:25:27.844099 metrics.go:23: INFO Metrics logging every 30s
2017/12/01 05:25:27.845095 logstash.go:91: INFO Max Retries set to: 3
2017/12/01 05:25:27.845095 outputs.go:108: INFO Activated logstash as output plugin.
2017/12/01 05:25:27.845095 publish.go:300: INFO Publisher name: CNKUSALLIEIAS04
2017/12/01 05:25:27.849100 async.go:63: INFO Flush Interval set to: 1s
2017/12/01 05:25:27.849100 async.go:64: INFO Max Bulk Size set to: 2048
2017/12/01 05:25:27.849100 winlogbeat.go:71: INFO State will be read from and persisted to C:\winlogbeat-5.6.4\data.winlogbeat.yml
Config OK

and I tried to execute .\winlogbeat.exe -c winlogbeat.yml -e -v -d "*", also it's successfully to transfer wineventlog to es.

is there any issue with windows server 2012? and how to fix it? really thanks.

Can you try starting the PowerShell console with elevated privileges (as administrator)?

Cool! Note action point 4.
Steps as per here:

yes,I've tried it(starting the PowerShell console with elevated privileges (as administrator)) several time,but still not work.

Can you start the service manually per services mmc? Can you get the service with Get-Service winlogbeat?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.