# Winlogbeat service stopped automaticly **URL:** \ **Category:** Beats\ **Tags:** windows, winlogbeat\ **Created:** [September 17, 2020, 7:14pm UTC](https://discuss.elastic.co/t/winlogbeat-service-stopped-automaticly/249026 "2020-09-17T19:14:05Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![collideroff](https://avatars.discourse-cdn.com/v4/letter/c/a88e57/32.png) [@collideroff](https://discuss.elastic.co/u/collideroff)\ **Post date:** [September 17, 2020, 7:14pm UTC](https://discuss.elastic.co/t/winlogbeat-service-stopped-automaticly/249026/1 "2020-09-17T19:14:06Z")
Good day! I have installed winlogbeat in WindowsServer 2012R2 on EventCollector. It's was istalled properly, but service automaticly stopped after several time..abou 12 hours on more. winlogbeat.event\_logs: - name: Application ignore\_older: 5000h - name: System ignore\_older: 5000h - name: Security ignore\_older: 5000h - name: ForwardedEvents ignore\_older: 5000h - name: Windows PowerShell ignore\_older: 5000h - name: Microsoft-Windows-NTLM/Operational ignore\_older: 5000h - name: Microsoft-Windows-PowerShell/Operational ignore\_older: 5000h - name: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational ignore\_older: 5000h - name: Microsoft-Windows-TaskScheduler/Operational ignore\_older: 5000h - name: Microsoft-Windows-SMBServer/Operational ignore\_older: 5000h - name: Microsoft-Windows-SMBClient/Connectivity ignore\_older: 5000h - name: Microsoft-Windows-SMBServer/Security ignore\_older: 5000h - name: Microsoft-Windows-SMBClient/Connectivity ignore\_older: 5000h - name: Microsoft-Windows-SMBClient/Operational ignore\_older: 5000h - name: Microsoft-Windows-SMBClient/Security ignore\_older: 5000h - name: Microsoft-Windows-Sysmon/Operational ignore\_older: 5000h tags: ["WindowsServer"] output.elasticsearch: hosts: ["elkdomain:8881"] setup.kibana: host: "[https://elkdomain:443](https://elkdomain:443)" protocol: "https" setup.ilm.overwrite: true #output.logstash: # hosts: ["elkdomain:5044"] #setup.template.enabled: false #setup.ilm.enabled: false #ilm.enabled: false logging.level: info logging.to\_files: true logging.files: path: C:/Program Files/Winlogbeat/logs name: winlogbeat keepfiles: 20 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 17, 2020, 10:33pm UTC](https://discuss.elastic.co/t/winlogbeat-service-stopped-automaticly/249026/2 "2020-09-17T22:33:27Z")
Welcome to our community! 😃 Please format your code/logs/config using the `` button, or markdown style back ticks. It helps to make things easy to read which helps us help you. What do your Winlogbeat logs show? ---
**Author:** ![collideroff](https://avatars.discourse-cdn.com/v4/letter/c/a88e57/32.png) [@collideroff](https://discuss.elastic.co/u/collideroff)\ **Post date:** [October 4, 2020, 12:08pm UTC](https://discuss.elastic.co/t/winlogbeat-service-stopped-automaticly/249026/3 "2020-10-04T12:08:56Z")
Sorry ☹ I dont use this blog before Config file: ``` winlogbeat.event_logs: - name: Application ignore_older: 5000h - name: System ignore_older: 5000h - name: Security ignore_older: 5000h - name: ForwardedEvents ignore_older: 5000h - name: Windows PowerShell ignore_older: 5000h - name: Microsoft-Windows-NTLM/Operational ignore_older: 5000h - name: Microsoft-Windows-PowerShell/Operational ignore_older: 5000h - name: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational ignore_older: 5000h - name: Microsoft-Windows-TaskScheduler/Operational ignore_older: 5000h - name: Microsoft-Windows-SMBServer/Operational ignore_older: 5000h - name: Microsoft-Windows-SMBClient/Connectivity ignore_older: 5000h - name: Microsoft-Windows-SMBServer/Security ignore_older: 5000h - name: Microsoft-Windows-SMBClient/Connectivity ignore_older: 5000h - name: Microsoft-Windows-SMBClient/Operational ignore_older: 5000h - name: Microsoft-Windows-SMBClient/Security ignore_older: 5000h - name: Microsoft-Windows-Sysmon/Operational ignore_older: 5000h tags: ["WindowsServer"] output.elasticsearch: hosts: ["elk.mydomain.tj:8881"] setup.kibana: host: "https://elk.mydomain.tj:443" username: "kibana" password: "password" protocol: "https" setup.ilm.overwrite: true #output.logstash: # hosts: ["elk.mydomain.tj:5044"] #setup.template.enabled: false #setup.ilm.enabled: false #ilm.enabled: false logging.level: info logging.to_files: true logging.files: path: C:/Program Files/Winlogbeat/logs name: winlogbeat keepfiles: 20 ``` Log: ``` 2020-09-18T10:30:34.389+0500 DEBUG [service] service/service.go:65 Received svc stop/shutdown request 2020-09-18T10:30:34.390+0500 INFO beater/winlogbeat.go:161 Stopping Winlogbeat 2020-09-18T10:30:34.391+0500 DEBUG [publisher] pipeline/client.go:166 client: done unlink 2020-09-18T10:30:34.391+0500 DEBUG [publisher] pipeline/client.go:177 client: cancelled 0 events 2020-09-18T10:30:34.391+0500 DEBUG [publisher] pipeline/client.go:164 client: unlink from queue 2020-09-18T10:30:34.391+0500 DEBUG [publisher] pipeline/client.go:166 client: done unlink 2020-09-18T10:30:34.683+0500 INFO [monitoring] log/log.go:154 Uptime: 11h33m26.812219s 2020-09-18T10:30:34.683+0500 INFO [monitoring] log/log.go:131 Stopping metrics logging. 2020-09-18T10:30:34.688+0500 INFO instance/beat.go:456 winlogbeat stopped. ``` After several time I must start service manually ☹ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 1, 2020, 2:09pm UTC](https://discuss.elastic.co/t/winlogbeat-service-stopped-automaticly/249026/4 "2020-11-01T14:09:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.