# Winlogbeat test config got both error and Config OK **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [May 7, 2018, 5:50pm UTC](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885 "2018-05-07T17:50:47Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Nickname\_Yu](https://avatars.discourse-cdn.com/v4/letter/n/67e7ee/32.png) [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)\ **Post date:** [May 7, 2018, 5:50pm UTC](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885/1 "2018-05-07T17:50:47Z")
## I'm installing Winlogbeat on a windows server 2016 DC. When I run winlogbeat test config, it gave both error and Config OK. Is it OK or Error then. winlogbeat.yml file as below winlogbeat.event\_logs: - name: Application ignore\_older: 24h - name: Security ignore\_older: 24h - name: System ignore\_older: 24h output.elasticsearch: hosts: - localhost:9200 setup.kibana: host: "localhost:5601" ## logging.to\_files: true logging.files: path: C:/ProgramData/winlogbeat/Logs logging.level: info # Command and output as below: PS C:\Program Files\winlogbeat\> .\winlogbeat.exe test config -c .\winlogbeat.yml -e .\winlogbeat.exe : 2018-05-07T17:40:40.108Z INFO instance/beat.go:468 Home path: [C:\Program Files\winlogbeat] Config path: [C:\Program Files\winlogbeat] Data path: [C:\Program Files\winlogbeat\data] Logs path: [C:\Program Files\winlogbeat\logs] At line:1 char:1 - .\winlogbeat.exe test config -c .\winlogbeat.yml -e - ```auto + CategoryInfo : NotSpecified: (2018-05-07T17:4...inlogbeat\logs]:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError ``` 2018-05-07T17:40:40.145Z INFO instance/beat.go:475 Beat UUID: 10395ff9-94ac-4391-b0d4-445cfdbaf898 2018-05-07T17:40:40.145Z INFO instance/beat.go:213 Setup Beat: winlogbeat; Version: 6.2.4 2018-05-07T17:40:40.146Z INFO elasticsearch/client.go:145 Elasticsearch url: [http://localhost:9200](http://localhost:9200) 2018-05-07T17:40:40.146Z INFO pipeline/module.go:76 Beat name: AZCWVTST1514 2018-05-07T17:40:40.146Z INFO beater/winlogbeat.go:56 State will be read from and persisted to C:\Program Files\winlogbeat\data.winlogbeat.yml Config OK ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 7, 2018, 7:01pm UTC](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885/2 "2018-05-07T19:01:07Z")
Can you wrap the config and output with triple backticks like this: ``` output ``` Otherwise it's impossible to understand Thanks ---
**Author:** ![Nickname\_Yu](https://avatars.discourse-cdn.com/v4/letter/n/67e7ee/32.png) [@Nickname\_Yu](https://discuss.elastic.co/u/Nickname_Yu)\ **Post date:** [May 8, 2018, 2:49am UTC](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885/3 "2018-05-08T02:49:56Z")
winlogbeat.yml ```auto winlogbeat.event_logs: - name: Application ignore_older: 24h - name: Security ignore_older: 24h - name: System ignore_older: 24h output.elasticsearch: hosts: - localhost:9200 setup.kibana: host: "localhost:5601" logging.to_files: true logging.files: path: C:/ProgramData/winlogbeat/Logs logging.level: info ``` test config output ```auto PS C:\Program Files\winlogbeat> .\winlogbeat.exe test config -c .\winlogbeat.yml -e .\winlogbeat.exe : 2018-05-07T17:40:40.108Z INFO instance/beat.go:468 Home path: [C:\Program Files\winlogbeat] Config path: [C:\Program Files\winlogbeat] Data path: [C:\Program Files\winlogbeat\data] Logs path: [C:\Program Files\winlogbeat\logs] At line:1 char:1 + .\winlogbeat.exe test config -c .\winlogbeat.yml -e + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (2018-05-07T17:4...inlogbeat\logs]:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError 2018-05-07T17:40:40.145Z INFO instance/beat.go:475 Beat UUID: 10395ff9-94ac-4391-b0d4-445cfdbaf898 2018-05-07T17:40:40.145Z INFO instance/beat.go:213 Setup Beat: winlogbeat; Version: 6.2.4 2018-05-07T17:40:40.146Z INFO elasticsearch/client.go:145 Elasticsearch url: http://localhost:9200 2018-05-07T17:40:40.146Z INFO pipeline/module.go:76 Beat name: AZCWVTST1514 2018-05-07T17:40:40.146Z INFO beater/winlogbeat.go:56 State will be read from and persisted to C:\Program Files\winlogbeat\data\.winlogbeat.yml Config OK ``` Hope this gives better format ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 8, 2018, 8:26am UTC](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885/4 "2018-05-08T08:26:23Z")
It seems that the following error: ```auto At line:1 char:1 + .\winlogbeat.exe test config -c .\winlogbeat.yml -e + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (2018-05-07T17:4...inlogbeat\logs]:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError ``` is just Powershell complaining that winlogbeat is printing messages to standard error output (stderr). This is caused by the `-e` flag in winlogbeat. You can run winlogbeat without the `-e` flag so it prints its log to `winlogbeat.log` or just ignore this error. It has nothing to do with the configuration. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 5, 2018, 8:26am UTC](https://discuss.elastic.co/t/winlogbeat-test-config-got-both-error-and-config-ok/130885/5 "2018-06-05T08:26:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.