Winlogbeat.yml path.data and path.logs not working

[iqworks (david c simmons)]

Hi, I am trying to change where my logs and data are stored. In my winlogbeat service properties i see this :

""D:\vm workstation\winlogbeat\winlogbeat.exe" --environment=windows_service -c "D:\vm workstation\winlogbeat\winlogbeat.yml" --path.home "D:\vm workstation\winlogbeat" --path.data "C:\ProgramData\winlogbeat" --path.logs "C:\ProgramData\winlogbeat\logs" -E logging.files.redirect_stderr=true"
At one point i changed where my winlogbeat folder resided. But the path.home shows the right path, but the logs and data paths are from where i originally installed it.
In the winlogbeat.yml, i see these :

#path.data: ${path.home}/data
#path.logs: ${path.home}/logs
and I thought if i changed them to:
path.logs: ${path.home}/logs
path.data: ${path.home}/data

And tested the yml and restarted the winlogbeat service, but the logs and data still went to the old programdata path. Not sure what i am doing wrong?

thanks for any help or advice

[jba (Jan Bruun Andersen)]

I am pretty sure that the setting specified on the command line (with --path.logs and --path.data) overrides whatever is the configuration file. I sure hope it do.

Well-behaved programs should follow the same rules for precedence when getting their configuration:

1. Command line parameters
2. Environment variables
3. Optional configuration file in the users home directory
4. The standard configuration file.

[iqworks (david c simmons)]

Thanks Jan for responding. I am thinking that if I use this:

that this would change where winlogbeat logs, data and config would put there logs, data and config as the defaults and are set when you restart the winlogbeat service?

--path.logs and --path.data are something you use when you want to change these defaults WHILE the winlogbeat service is running?

hope i have that straight?

Thanks again Jan for responding

[jba (Jan Bruun Andersen)]

I have no experience with WinLogBeat, but think the environment=windows_service means that it will run as a background service with the values for path.home, path.data, and path.logs that are set on the command line that you showed. It will ignore whatever you set those values to in the winlogbeat.yml file. Any other settings, like the keystore etc, will still be used because these values are not part of the command line that starts the service.