from a command line, it's working (with the latest binPath) :
but the service is not :
PS C:\Program Files\Winlogbeat> Start-Service winlogbeat
Start-Service : Le service « winlogbeat (winlogbeat) » ne peut pas démarrer en raison de l'erreur suivante : Impossible de démarrer le service winlogbeat sur l'ordinateur '.'.
Au caractère Ligne:1 : 1
+ Start-Service winlogbeat
+ ~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
+ FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
with "\"C:\Program Files\Winlogbeat\winlogbeat.exe\" -c \"C:\Program Files\Winlogbeat\winlogbeat.yml\" --path.home \"C:\Program Files\Winlogbeat\" --path.config \"C:\Program Files\Winlogbeat\" --path.data \"C:\Program Files\Winlogbeat\" --path.logs \"C:\Program Files\Winlogbeat\" -E logging.files.redirect_stderr=true" as a binPath, I get :
PS C:\Program Files\Winlogbeat> Start-Service winlogbeat
Start-Service : Le service « winlogbeat (winlogbeat) » ne peut pas démarrer en raison de l'erreur suivante : Impossible de démarrer le service winlogbeat sur l'ordinateur '.'.
Au caractère Ligne:1 : 1
+ Start-Service winlogbeat
+ ~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
+ FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe -c .\Config_test.yml run -e -d "*"
{"log.level":"info","@timestamp":"2024-04-30T12:23:24.265+0200","log.origin":{"file.name":"instance/beat.go","file.line":806},"message":"Home path: [C:\\Program Files\\Winlogbeat] Config path: [C:\\Program Files\\Winlogbeat] Data path: [C:\\Program Files\\Winlogbeat\\data] Logs path: [C:\\Program Files\\Winlogbeat\\logs]","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:23:24.364+0200","log.logger":"beat","log.origin":{"file.name":"instance/beat.go","file.line":897},"message":"Beat metadata path: C:\\Program Files\\Winlogbeat\\data\\meta.json","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-04-30T12:23:24.369+0200","log.origin":{"file.name":"instance/beat.go","file.line":814},"message":"Beat ID: 8dbbbb47-2410-4c0c-b688-6c72cb8b6d2a","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:23:24.414+0200","log.logger":"conditions","log.origin":{"file.name":"conditions/conditions.go","file.line":98},"message":"New condition contains: map[]","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:23:24.414+0200","log.logger":"conditions","log.origin":{"file.name":"conditions/conditions.go","file.line":98},"message":"New condition !contains: map[]","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:23:24.418+0200","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/providers.go","file.line":130},"message":"add_cloud_metadata: starting to fetch metadata, timeout=3s","service.name":"winlogbeat","ecs.version":"1.6.0"}
with "\"C:\Program Files\Winlogbeat\winlogbeat.exe\" --path.home \"C:\Program Files\Winlogbeat\" --path.config \"C:\Program Files\Winlogbeat\" --path.data \"C:\Program Files\Winlogbeat\" --path.logs \"C:\Program Files\Winlogbeat\" -E logging.files.redirect_stderr=true", I get :
PS C:\Program Files\Winlogbeat> Start-Service winlogbeat
Start-Service : Le service « winlogbeat (winlogbeat) » ne peut pas démarrer en raison de l'erreur suivante : Impossible de démarrer le service winlogbeat sur l'ordinateur '.'.
Au caractère Ligne:1 : 1
+ Start-Service winlogbeat
+ ~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
+ FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
with "\"C:\Program Files\Winlogbeat\winlogbeat.exe\" --path.home \"C:\Program Files\Winlogbeat\" --path.data \"C:\Program Files\Winlogbeat\" --path.logs \"C:\Program Files\Winlogbeat\" -E logging.files.redirect_stderr=true" I have the same
with "\"C:\Program Files\Winlogbeat\winlogbeat.exe\" --path.home \"C:\Program Files\Winlogbeat\" --path.logs \"C:\Program Files\Winlogbeat\" -E logging.files.redirect_stderr=true" same
with "\"C:\Program Files\Winlogbeat\winlogbeat.exe\" -E logging.files.redirect_stderr=true" same
with "\"C:\Program Files\Winlogbeat\winlogbeat.exe\"" same
but with every dataPath, running the winlogbeat with the .exe works :
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe -c .\Config_test.yml run -e -d "*"
{"log.level":"info","@timestamp":"2024-04-30T12:29:26.328+0200","log.origin":{"file.name":"instance/beat.go","file.line":806},"message":"Home path: [C:\\Program Files\\Winlogbeat] Config path: [C:\\Program Files\\Winlogbeat] Data path: [C:\\Program Files\\Winlogbeat\\data] Logs path: [C:\\Program Files\\Winlogbeat\\logs]","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:26.406+0200","log.logger":"beat","log.origin":{"file.name":"instance/beat.go","file.line":897},"message":"Beat metadata path: C:\\Program Files\\Winlogbeat\\data\\meta.json","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-04-30T12:29:26.411+0200","log.origin":{"file.name":"instance/beat.go","file.line":814},"message":"Beat ID: 8dbbbb47-2410-4c0c-b688-6c72cb8b6d2a","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:26.469+0200","log.logger":"conditions","log.origin":{"file.name":"conditions/conditions.go","file.line":98},"message":"New condition contains: map[]","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:26.469+0200","log.logger":"conditions","log.origin":{"file.name":"conditions/conditions.go","file.line":98},"message":"New condition !contains: map[]","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:26.476+0200","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/providers.go","file.line":130},"message":"add_cloud_metadata: starting to fetch metadata, timeout=3s","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:29.480+0200","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/providers.go","file.line":167},"message":"add_cloud_metadata: received disposition for gcp after 3.0020806s. result=[provider:gcp, error=failed requesting gcp metadata: Get \"http://169.254.169.254/computeMetadata/v1/?recursive=true&alt=json\": dial tcp 169.254.169.254:80: i/o timeout, metadata={}]","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-04-30T12:29:29.481+0200","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed requesting gcp metadata: Get \"http://169.254.169.254/computeMetadata/v1/?recursive=true&alt=json\": dial tcp 169.254.169.254:80: i/o timeout","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:29.485+0200","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/providers.go","file.line":176},"message":"add_cloud_metadata: timed-out waiting for all responses","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:29.486+0200","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/providers.go","file.line":133},"message":"add_cloud_metadata: fetchMetadata ran for 3.0080136s","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-04-30T12:29:29.487+0200","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/add_cloud_metadata.go","file.line":100},"message":"add_cloud_metadata: hosting provider type not detected.","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:29.487+0200","log.logger":"processors","log.origin":{"file.name":"processors/processor.go","file.line":114},"message":"Generated new processors: add_host_metadata=[netinfo.enabled=[true], cache.ttl=[5m0s]], condition=!contains: map[], add_cloud_metadata={}","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-04-30T12:29:29.489+0200","log.logger":"seccomp","log.origin":{"file.name":"seccomp/seccomp.go","file.line":97},"message":"Syscall filtering is only supported on Linux","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-04-30T12:29:29.490+0200","log.logger":"beat","log.origin":{"file.name":"instance/beat.go","file.line":1332},"message":"Beat info","service.name":"winlogbeat","system_info":{"beat":{"path":{"config":"C:\\Program Files\\Winlogbeat","data":"C:\\Program Files\\Winlogbeat\\data","home":"C:\\Program Files\\Winlogbeat","logs":"C:\\Program Files\\Winlogbeat\\logs"},"type":"winlogbeat","uuid":"8dbbbb47-2410-4c0c-b688-6c72cb8b6d2a"},"ecs.version":"1.6.0"}}
and the config still works :
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test output
elasticsearch: https://<server_ip>:9200...
parse url... OK
connection...
parse host... OK
dns lookup... OK
addresses: <server_ip>
dial up... OK
TLS...
security: server's certificate chain verification is enabled
handshake... OK
TLS version: TLSv1.3
dial up... OK
talk to server... OK
version: 8.13.2
I just upgraded my ELK to 8.13.2
BUT
by setting the config in HTTP with the latest binPath => not working
with HTTP with the before binPath => working 
with HTTPS with the before binPath => not working
with HTTPS with the latest binPath => not working
so I stayed with the first binPath, but it's weird that I can use winlogbeat with the .exe and is working perfectly fine, but when I start the service, it's not working.
I though, maybe the name of my file was wrong, so I renamed the file Config_test.yml to winlogbeat.yml because it's the one used by default. and it changed nothing.
So :
- the .exe works with everything (he doesn't care at all about the binPath I think)
- the service works only in http with the first binPath
is there an argument that we can add to tell the service to work in HTTPS or something ? Or it should be working with the config I have ?
