Hey Folks, Running into some fatal errors with Winlogbeat. Started happening around 8.7.0 and I am now getting to try to fix it. I was on 8.6.2 and and was working fine, anything 8.7+ it has a fatal error but if I go back to 8.6.2 works fine. Installed on Windows 10 fully patched. Nothing specia…

[image] dwissm1: winlogbeat.event_logs: - name: Application event_id: 1000, 1002 ignore_older: 72h level: error provider: - Application Error - Application Hang - name: Application event_id: 1001 ignore_older: 72h level: info provider: - Wind…

Can you please share the configuration file you are using as well.

Sure. Jinja: elasticsearch_host: "x.x.1.7:9200" protocol: "https" elasticsearch_user: "elastic" kibana_host: "x.x.1.7:5601" path: home: c:\Program Files\winlogbeat config: c:\Program Files\winlogbeat data: c:\ProgramData\winlogbeat logs: c:\ProgramData\winlogbeat\logs winlogbeat.event_lo…

[image] dwissm1: "message":"Failed due to panic.","service.name":"winlogbeat","error":{"message":"name Application already used"} On your winlogbeat.yml you have the Application name (and also others like Security and System) multiple times. Example: [image] dwissm1: winlogbeat.event_lo…

Thanks for the reply... unless something changes in 8.7... Ive been using that config for about 3 years without issues. The issue arose between 8.6.2 and 8.7.0. Config Comes from here: jhochwald/Universal-Winlogbeat-configuration/blob/main/assets/winlogbeat.yml # Define the output…

[image] dwissm1: Thanks for the reply... unless something changes in 8.7... Ive been using that config for about 3 years without issues. The issue arose between 8.6.2 and 8.7.0. Yeah, I was looking into the release notes from 8.6.2 until 8.8.1 and didn't find anything related to it. Not sure…

On what operating system are the winlogbeat's generating the fatal errors running? Just asking because I think I read somewhere support for 2008 / XP and some older os'es has stopped some time ago.

Same issue here. Followed, used, and generated Winlogbeat config via GitHub - ElasticSA/wec_pepped: Pep up your Windows Event Collector (WEC) for Windows Event Forwarding (WEF) . Followed the WEC Server Cookbook guide. Winlogbeat is installed on Windows Server 2022. Been working for the past 2 years…

@andrewkroh any chance you were able to find the issue? Looks like someone else is hitting the same issue.

Adding id for similar Channel entries worked for me. Thank you!

Discuss the Elastic Stack

Winlogbeat Fatal Error 8.7.0+ name already used

Elastic Stack Beats

Topic		Replies	Views
Winlogbeat 8.7.1 service crashes immediately after starting Beats winlogbeat	7	823	June 7, 2023
No Alerts in Winlogbeat Beats winlogbeat	4	782	May 1, 2023
Errors with filebeat when trying to integrate any windows integration logs with the agent Elastic Agent filebeat	26	385	August 7, 2025
Winlogbeat freezes Beats winlogbeat	5	125	March 24, 2025
Winlogbeat continuously crashes on Windows 2003 server Beats winlogbeat	18	3250	November 4, 2022

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Winlogbeat Fatal Error 8.7.0+ name already used

Related topics