# Winlogbeat wont start as a Service

**URL:** <https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/168265>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 13, 2019, 6:02pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/168265 "2019-02-13T18:02:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dfoley84](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dfoley84/32/38973_2.png) [@dfoley84](https://discuss.elastic.co/u/dfoley84)\
**Post date:** [February 13, 2019, 6:02pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/168265/1 "2019-02-13T18:02:23Z")

</div>

Hi,

I am after install Elastic search and Kibana for the main task of holding WEF logs from our Servers:

while trying to start winlog "service-start winlogbeat" I am getting the following Error:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/5/3576f1d8033ce882ac706ecc8d6f751fb2c05725.png)

However I am able to start it "winlogbeat.exe -c winlogbeat.yml -e -v -d "\*""

by which i can see logs within Kibana

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 13, 2019, 7:08pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/168265/2 "2019-02-13T19:08:17Z")

</div>

When it fails to start as a service what's written to the winlogbeat log file?

---

<div class="post-metadata">

**Author:** ![dfoley84](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dfoley84/32/38973_2.png) [@dfoley84](https://discuss.elastic.co/u/dfoley84)\
**Post date:** [February 13, 2019, 9:12pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/168265/3 "2019-02-13T21:12:09Z")

</div>

When i open Services

"Windows could not start the winlogbeat service on Local Computer"

Error2: the system cannot find the file specified

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 13, 2019, 10:22pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/168265/4 "2019-02-13T22:22:54Z")

</div>

Did you move the folder containing the winlogbeat.exe after running the install script?

In any case, open the properties of the service and check the command that it's running to verify the path points to winlogbeat.exe you are running manually.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2019, 10:22pm UTC](https://discuss.elastic.co/t/winlogbeat-wont-start-as-a-service/168265/5 "2019-03-13T22:22:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.