# Winlogbeat

**URL:** <https://discuss.elastic.co/t/winlogbeat/103293>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 10, 2017, 5:14am UTC](https://discuss.elastic.co/t/winlogbeat/103293 "2017-10-10T05:14:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![fatmafouad\_y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fatmafouad_y/32/22912_2.png) [@fatmafouad\_y](https://discuss.elastic.co/u/fatmafouad_y)\
**Post date:** [October 10, 2017, 5:14am UTC](https://discuss.elastic.co/t/winlogbeat/103293/1 "2017-10-10T05:14:30Z")

</div>

I got an error when I delete winlogbeat for the first time ...

error is : Get-Process : Parameter cannot be processed because the parameter name 'e' is ambiguous. Possible matches include: -Err  
orAction -ErrorVariable.  
At line:1 char:3

- PS \<\<\<\< C:\Program Files\WinLogbeat\>.\winlogbeat.exe -c winlogbeat.yml -e -v -d "\*"
  - CategoryInfo : InvalidArgument: (🙂 [Get-Process], ParameterBindingException
  - FullyQualifiedErrorId : AmbiguousParameter,Microsoft.PowerShell.Commands.GetProcessCommand

any help!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 10, 2017, 1:17pm UTC](https://discuss.elastic.co/t/winlogbeat/103293/2 "2017-10-10T13:17:04Z")

</div>

> [@fatmafouad\_y](#):
>
> I got an error when I delete winlogbeat for the first time ...

What are you trying to accomplish? Uninstall Winlogbeat? What is the exact command you entered? What OS version is this? What Winlogbeat version are you running?

---

<div class="post-metadata">

**Author:** ![fatmafouad\_y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fatmafouad_y/32/22912_2.png) [@fatmafouad\_y](https://discuss.elastic.co/u/fatmafouad_y)\
**Post date:** [October 11, 2017, 1:27pm UTC](https://discuss.elastic.co/t/winlogbeat/103293/3 "2017-10-11T13:27:16Z")

</div>

hello sir

i'm just trying to send beat logs from win 7 to centos 7 ...  
winlogbeat 5.6.2  
yes i uninstall winlogbeat as service in my win7 machine

I run :

cd "C:\Program Files\Winlogbeat"

powershell.exe -ExecutionPolicy UnRestricted -File  
.\install-service-winlogbeat.ps1

Start-Service winlogbeat

using powershell

winlogbeat.event\_logs:

- name: Application  
ignore\_older: 72h

# The tags of the shipper are included in their own field with each

# transaction published.

#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the

# output.

#fields:

# env: staging

#================================ Outputs

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 11, 2017, 7:31pm UTC](https://discuss.elastic.co/t/winlogbeat/103293/4 "2017-10-11T19:31:13Z")

</div>

After starting the service what is in the winlogbeat log file? The log should be in `C:\Program Files\Winlogbeat\logs\`.

---

<div class="post-metadata">

**Author:** ![fatmafouad\_y](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fatmafouad_y/32/22912_2.png) [@fatmafouad\_y](https://discuss.elastic.co/u/fatmafouad_y)\
**Post date:** [October 12, 2017, 1:19pm UTC](https://discuss.elastic.co/t/winlogbeat/103293/5 "2017-10-12T13:19:51Z")

</div>

this is log file sir

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 12, 2017, 1:30pm UTC](https://discuss.elastic.co/t/winlogbeat/103293/6 "2017-10-12T13:30:36Z")

</div>

I see this in your log.

```auto
2017-09-30T15:07:03+03:00 ERR Connecting error publishing events (retrying): Get http://localhost:9200: dial tcp [::1]:9200: connectex: No connection could be made because the target machine actively refused it.

```

Winlogbeat is unable to connect to Elasticsearch at [http://localhost:9200](http://localhost:9200). Probably some kind of firewall or security tool blocking the connection.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2017, 1:30pm UTC](https://discuss.elastic.co/t/winlogbeat/103293/7 "2017-11-09T13:30:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.