# Winlogbeat service can not start
**URL:** https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926
**Category:** Beats
**Tags:** winlogbeat
**Created:** [May 8, 2018, 3:28am UTC](https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926 "2018-05-08T03:28:23Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)
#### Post date: [May 8, 2018, 3:28am UTC](https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926/1 "2018-05-08T03:28:23Z")
Hi there, I'm configuring winlogbeat and trying to start it. The first time I installed winlogbeat service, and started it, it worked fine. Well, after several hours, it couldn't start with errors. I uninstalled the service, re-installed the service, still doesn't work. Below is the error message.
```auto
PS C:\Program Files\winlogbeat> Start-Service winlogbeat -Verbose
VERBOSE: Performing the operation "Start-Service" on target "winlogbeat (winlogbeat)".
Start-Service : Service 'winlogbeat (winlogbeat)' cannot be started due to the following error: Cannot start service winlogbeat on computer '.'.
At line:1 char:1
+ Start-Service winlogbeat -Verbose
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
+ FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
```
Winlogbeat.yml
```auto
winlogbeat.event_logs:
- name: Application
ignore_older: 24h
- name: Security
ignore_older: 24h
- name: System
ignore_older: 24h
output.elasticsearch:
hosts:
- localhost:9200
setup.kibana:
host: "localhost:5601"
logging.to_files: true
logging.files:
path: C:/ProgramData/winlogbeat/Logs
logging.level: info
```
I get the command to start this service, and try to run the command directly, and got the error below:
``````````````````````````````````````````````auto
PS C:\Program Files\winlogbeat> "C:\Program Files\winlogbeat\\winlogbeat.exe" -c "C:\Program Files\winlogbeat\\winlogbeat.yml" -path.home "C:\Program Files\winlogbeat" -path.data "C:\\ProgramData\\winlogbeat" -path.logs "C:\\ProgramData\\winlogbeat\logs"
At line:1 char:47
+ "C:\Program Files\winlogbeat\\winlogbeat.exe" -c "C:\Program Files\wi ...
+ ~~
Unexpected token '-c' in expression or statement.
At line:1 char:50
+ ... logbeat.exe" -c "C:\Program Files\winlogbeat\\winlogbeat.yml" -path.h ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Unexpected token '"C:\Program Files\winlogbeat\\winlogbeat.yml"' in expression or statement.
At line:1 char:96
+ ... t.exe" -c "C:\Program Files\winlogbeat\\winlogbeat.yml" -path.home "C ...
+ ~~~~~
Unexpected token '-path' in expression or statement.
At line:1 char:101
+ ... " -c "C:\Program Files\winlogbeat\\winlogbeat.yml" -path.home "C:\Pro ...
+ ~~~~~
Unexpected token '.home' in expression or statement.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : UnexpectedToken
`````````````````````````````````````````````
Any idea?
``````````````````````````````````````````````
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [May 8, 2018, 8:40pm UTC](https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926/2 "2018-05-08T20:40:16Z")
Hello @Nickname_Yu
A few questions:
- What version of winlogbeat do you use?
- Did you run the uninstaller script?
If I understand correctly, It used to work and start and it stopped working?
---
### Author:  [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)
#### Post date: [May 8, 2018, 9:15pm UTC](https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926/3 "2018-05-08T21:15:31Z")
I'm using the latest version downloaded yesterday, supposed to be 6.2.4.
The problem disappeared this morning. All what I did was shutdown the server yesterday and started it this morning. It's weird.
Any idea what I can do next time the problem occurs?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 5, 2018, 9:15pm UTC](https://discuss.elastic.co/t/winlogbeat-service-can-not-start/130926/4 "2018-06-05T21:15:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.