I have installed Winlogbeat 7.6.2 with the new MSI installer. The installer works very well and simplifies installation and maintenance of beats on Windows hosts. The only problem is that the installer does not contain an option to run the beat as a service. As well, there is no create-service script available anymore as with older versions. As a workaround I have modified the service script of 7.4.2 to fit to the new directory structure. Please let me know the reason why the service creation part is missing and what your proposed solution is to run a beat as a service using MSI.
Kind regards
Bernhard
Hi @bernhard.fluehmann - Before I share more information with you, the MSI for Winlogbeat is still in Beta version.
From my understanding, the MSI creates the service. However, as raised in this issue, there is a lack of documentation around the steps required for installing/configuring Winlogbeat when using the MSI.
Hi @ropc - Thank you for your fast reply. I am aware about the Beta state. Nevertheless MSI is the preferred way to install software on windows and I guess people start using it as soon as it is available even if not GA. As a side note, MSI for Elasticsearch is now in beta since 6.8 which is a long time. I have just opened an issue with a request to put it to GA.
Thank you for pointing me to the issue. As described there it seems that the installer should actually create the service, which is not the case on my installs (Windows Server 2019 and Windows 10). As already mentioned, creating the service manually works. This is why I thought the service piece was missing in the installer.
You're welcome @bernhard.fluehmann. Do take note that Winlogbeat is not supported on Windows 10 and it is supported on Windows Server 2019 starting from version 7.4.x. Please refer to our support matrix for further details.
Ok. The reason why I installed it on Windows 10 was to double check with another version. If Win 10 is not supported, fine. Let's focus on Windows 2019 then. What I am interested in is to know if the service creation is missing at all or just on my install. The issue deals more with documentation issues which is not a problem for me since I understand the file structure and it makes sense. If run with defaults, the installer even opens the ProgramData folder where the config file has to be placed, which is very handy.
Hello @bernhard.fluehmann!
Please let me clarify this a bit. Beats MSI packages do install windows services where appropriate and add CLI support as well. They do not start the service though. Reason for that is outlined in the last screen of the installer - package doesn't contain a good configuration file.
We plan to add support for configuration migration on upgrades as well as bundling user-supplied configuration files to be installed when MSI runs.
About Windows 10: while Win10 is a client SKU and not officially supported, it shares vast amounts of code with server SKUs. There is no technical reason that I am aware of that would preclude Winlogbeat from working on a Professional variant, I cannot vouch for Home variant.
Have a great day!
Hi @ygel
Thank you for the explanation. It finally got it working. As described in the helptext the display name of the service is Elastic <beatname> <version>. I missed that peace since in zip beat package, name and displayname were the same 
. Thanks again for your fast help @ygel and @ropc
1 Like
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.