# Winlogbeat message\_error: "The system cannot find the file specified." **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [April 22, 2016, 6:55am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125 "2016-04-22T06:55:40Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [April 22, 2016, 6:55am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/1 "2016-04-22T06:55:40Z")
Hi, we have a lot of Windows Systems which are forwarding all their events to a central window system. From their I want to move the messages to logstash by using WinLogBeat. It works fine for all "Windows OS" Events, but when it forwards events from Applications like Citrix, I receive as message only: message\_error The system cannot find the file specified. instead of the real message., In the queue of the forwarded events, the message still looks fine. Any idea? Thank you ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 22, 2016, 12:26pm UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/2 "2016-04-22T12:26:28Z")
What operating systems are involved here? What version of Winlogbeat? Please report what format you are using for your forwarded events (event vs rendered event). See the comment here. [https://github.com/elastic/beats/issues/1031#issuecomment-196491503](https://github.com/elastic/beats/issues/1031#issuecomment-196491503) If you haven't already tried Winlogbeat v5, could you run a test with it and see if you get the same behavior. There were some changes to how the events are read. ---
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [April 24, 2016, 12:06pm UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/3 "2016-04-24T12:06:54Z")
> [@andrewkroh](#): > > What operating systems are involved here? What version of Winlogbeat? > > Please report what format you are using for your forwarded events (event vs rendered event). See the comment here. [Winlogbeat - Test Usage on Windows Event Collector · Issue #1031 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/1031#issuecomment-196491503) > > If you haven't already tried Winlogbeat v5, could you run a test with it and see if you get the same behavior. There were some changes to how the events are read. Hi, we have \> 2000 Win2008 and Win2012 which are forwarding their events to a central win2012 system. looking at the "forwarded events" of the central system, all messages have content, so I assume the rendered event is forwarded. It seems winlogbeat try to render again, which will fail for most of the application events, because no application is installed on the central log forwarder. Is there a way to change this? will try winlogbeat 5 next week. ---
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [April 26, 2016, 6:16am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/4 "2016-04-26T06:16:20Z")
Hi, I installed winlogbeat 5 alpha, it transfers some messages and then crashes... ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 26, 2016, 6:29am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/5 "2016-04-26T06:29:26Z")
Do you have a logs or a stack trace? The logs are probably in `C:\ProgramData\winlogbeat\logs\` unless you changed some config. ---
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [April 26, 2016, 7:44am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/6 "2016-04-26T07:44:47Z")
2016-04-26T08:57:31+02:00 DBG EventLog[Security] Read() returned 0 records 2016-04-26T08:57:31+02:00 DBG WinEventLog[ForwardedEvents] EventHandles returned 7 handles 2016-04-26T08:57:31+02:00 DBG WinEventLog[ForwardedEvents] Read() is returning 7 records 2016-04-26T08:57:31+02:00 DBG EventLog[ForwardedEvents] Read() returned 7 records 2016-04-26T08:57:31+02:00 DBG Publish: { "@timestamp": "2016-04-26T06:57:00.000Z", "beat": { "hostname": "xxxxx", "name": "xxxxxx" }, "computer\_name": "xxxxxx", "count": 1, "event\_id": 1, "level": "", "log\_name": "Application", "message\_error": "The system cannot find the file specified.", "record\_number": "136754", "source\_name": "DirXML Remote Loader", "type": "wineventlog" } 2016-04-26T08:57:31+02:00 DBG Publish: { "@timestamp": "2016-04-26T06:57:15.000Z", "beat": { "hostname": "xxxxx", "name": "xxxxx" }, "computer\_name": "xxxxxx", "count": 1, "event\_id": 1, "level": "", "log\_name": "Application", "message\_error": "The system cannot find the file specified.", "record\_number": "136755", "source\_name": "DirXML Remote Loader", "type": "wineventlog" }...... ---
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [April 28, 2016, 12:17pm UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/7 "2016-04-28T12:17:38Z")
Hi Andrew, some greeting from Monica Sarbu, I met her at the OSDC 2016 in Berlin and ask her if she can support me and she told me there is one Expert for WinLogBeat and thats you! ;.-) btw: Do you need more information from me regarding this issue? and in addition a question, yesterday I lost a log of logs from the linux world, just because the first event which where generated yesterday was a windows event log which included a field user defined as a array consist of username and domain. In my syslog events there is also a field user extracted, this field is a plain string... and elasticsearch doesn't want to save my linux logs anymore. do you have a Idea how to avoid this in the future. THANK YOU ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 28, 2016, 12:40pm UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/8 "2016-04-28T12:40:18Z")
Hi @Markus_Korn, > [@Markus\_Korn](#): > > so I assume the rendered event is forwarded Can you use the [Wecutil.exe](https://msdn.microsoft.com/en-us/library/bb736545%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396) tool to dump your subscription configuration to XML and paste the XML here. Please start another thread for your other question since it's unrelated (it helps future people that try to solve the same problems). Describe your setup and config for that issue. ---
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [April 28, 2016, 3:12pm UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/10 "2016-04-28T15:12:50Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/5/56d0ec7579453e569a913b5c562b6d7bfbef68d3.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [May 19, 2016, 9:09pm UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/11 "2016-05-19T21:09:17Z")
Sorry for the long delay. I finally setup a test environment for this. I used two Windows 2012R2 servers and Winlogbeat 5.0-alpha2. In my testing I found that both `message` and `message_error` are being reporting in events when the source application is not installed on the event collector. The reason is because Winlogbeat attempts to render the event using message files from the local computer and Windows returns an error whose message is "The system cannot find the file specified." Then in an error recovery attempt, it tries to render the event without the message string since it thinks the message file is missing. However during the recovery attempt it is able to fully render the event with its message. When Winlogbeat recovers from the rendering error it reports both the event and the original error that caused the problem. This normally makes sense because the actual `message` field is still missing. But in this case it doesn't because the full event with message was rendered by Windows. I'll work on addressing this problem of having both `message` and `message_error`. ```auto { "@timestamp": "2016-05-19T19:06:19.000Z", "beat": { "hostname": "WIN-0660TQ4U6V4", "name": "winlogbeat-001" }, "computer_name": "wrks-001.elastic.co", "event_data": { "param1": "in24.inetnebr.com - - [01/Aug/1995:00:00:01 -0400] \"GET /shuttle/missions/sts-68/news/sts-68-mcc-05.txt HTTP/1.0\" 200 1839" }, "event_id": 512, "keywords": [ "Classic" ], "level": "Information", "log_name": "Application", "message": "in24.inetnebr.com - - [01/Aug/1995:00:00:01 -0400] \"GET /shuttle/missions/sts-68/news/sts-68-mcc-05.txt HTTP/1.0\" 200 1839", "message_error": "The system cannot find the file specified.", "opcode": "Info", "record_number": "7609", "source_name": "DummyCustomApp", "tags": [ "ec2" ], "type": "wineventlog", "xml": " 512 4 0 0x80000000000000 7609 Application wrks-001.elastic.co in24.inetnebr.com - - [01/Aug/1995:00:00:01 -0400] \"GET /shuttle/missions/sts-68/news/sts-68-mcc-05.txt HTTP/1.0\" 200 1839 in24.inetnebr.com - - [01/Aug/1995:00:00:01 -0400] \"GET /shuttle/missions/sts-68/news/sts-68-mcc-05.txt HTTP/1.0\" 200 1839 Information Info Classic " } ``` (The XML is included because I configured Winlogbeat to include the raw XML received from Windows for debugging purposes using the `include_xml: true` setting.) ---
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [May 20, 2016, 9:10am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/12 "2016-05-20T09:10:13Z")
Great!!! Thank you! Andrew Kroh [noreply@elastic.co](mailto:noreply@elastic.co) schrieb am Do., 19. Mai 2016 um 23:19 Uhr: ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 8, 2016, 2:19pm UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/13 "2016-08-08T14:19:27Z")
This issue was [fixed](https://github.com/elastic/beats/pull/1891) in 5.0.0-alpha4. ---
**Author:** ![Markus\_Korn](https://avatars.discourse-cdn.com/v4/letter/m/b38774/32.png) [@Markus\_Korn](https://discuss.elastic.co/u/Markus_Korn)\ **Post date:** [August 9, 2016, 7:43am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/14 "2016-08-09T07:43:08Z")
Great Job! - Forwarded Events are not loosing message anymore - CPU and RAM footprint is less than compared to 2.1 THANK YOU ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 16, 2016, 7:43am UTC](https://discuss.elastic.co/t/winlogbeat-message-error-the-system-cannot-find-the-file-specified/48125/15 "2016-08-16T07:43:08Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.