Winlogbeat TLS Connection to Logstash

See the getting started guide: Winlogbeat quick start: installation and configuration | Winlogbeat Reference [8.11] | Elastic The config file will be in the directory where you unzipped the download. There are no plugins, just the one EXE file.

Instead of starting Winlogbeat as a service, when debugging problems it is better to start the process on the command line and run it in the foreground. This way you can immediately see the errors.

So open a PowerShell prompt and change the directory to the location where you unzipped it (see the getting started guide).

PS C:\where\you\extracted\winlogbeat > .\winlogbeat.exe -c winlogbeat.yml -e -v

Add -d "*" if you want event more verbose output.

Once you have it running without errors, then stop the process and start it as a service.