# \#windows **URL:** https://discuss.elastic.co/tag/windows/44.md [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) --- ## [ElasticDefendStatus - File not found (v9.3.0)](https://discuss.elastic.co/t/elasticdefendstatus-file-not-found-v9-3-0/384899)
**Author:** [@adamsmesher](https://discuss.elastic.co/u/adamsmesher)\ **Replies:** 4\ **Last updated:** [February 6, 2026, 6:39pm UTC](https://discuss.elastic.co/t/elasticdefendstatus-file-not-found-v9-3-0/384899 "2026-02-06T18:39:33Z")
Hi Everyone! After updating to version 9.3, the Elastic Defend status is not displayed on the endpoints. file:///C:/Program%20Files/Elastic/Endpoint/cache/ElasticDefendStatus.html Register as antivirus - Sync with … --- ## [Error with Windows Endpoint](https://discuss.elastic.co/t/error-with-windows-endpoint/381313)
**Author:** [@yen3](https://discuss.elastic.co/u/yen3)\ **Replies:** 2\ **Last updated:** [August 27, 2025, 2:52pm UTC](https://discuss.elastic.co/t/error-with-windows-endpoint/381313 "2025-08-27T14:52:15Z")
I'm having trouble accessing the Windows Endpoint on the Strigo terminal. I've tried restarting the machine several times, but the same error keeps showing up. Could anyone help me figure out what's going on? I'm stuck … --- ## [Winlogbeat not parsing AnsiString fields correctly](https://discuss.elastic.co/t/winlogbeat-not-parsing-ansistring-fields-correctly/378510)
**Author:** [@AltairQ](https://discuss.elastic.co/u/AltairQ)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 8:34am UTC](https://discuss.elastic.co/t/winlogbeat-not-parsing-ansistring-fields-correctly/378510 "2025-05-27T08:34:23Z")
Hello, I'd like to draw attention to what I believe is a bug in winlogbeat v9+ parsing logic for ETW events declared with inType="win:AnsiString". Long story short, the strings are not trimmed to the null terminator. I… --- ## [Drill-down support in kibana Enterprise 2022.10.4 (build 117134)](https://discuss.elastic.co/t/drill-down-support-in-kibana-enterprise-2022-10-4-build-117134/377560)
**Author:** [@Guy\_Levin](https://discuss.elastic.co/u/Guy_Levin)\ **Replies:** 0\ **Last updated:** [April 28, 2025, 7:14am UTC](https://discuss.elastic.co/t/drill-down-support-in-kibana-enterprise-2022-10-4-build-117134/377560 "2025-04-28T07:14:15Z")
I have Kibana Enterprise 2022.10.4 (build 117134). I noticed that when I try to add a drill-down, there are two choices. The "go to dashboard" choice is enabled. The "go to url" is disabled. Is this disablement becau… --- ## [Clarification on winlog.event\_data.paramXX Field in Windows System Application Logs](https://discuss.elastic.co/t/clarification-on-winlog-event-data-paramxx-field-in-windows-system-application-logs/375759)
**Author:** [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 7:08am UTC](https://discuss.elastic.co/t/clarification-on-winlog-event-data-paramxx-field-in-windows-system-application-logs/375759 "2025-03-12T07:08:01Z")
Hi All, While browsing the Windows system.application logs, I came across the field winlog.event\_data.paramXX. After reviewing the Elasticsearch documentation, I noticed that this field is mentioned as a keyword type, b… --- ## [Sysmon registry logs don't get to elastic](https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 0\ **Last updated:** [February 19, 2025, 1:53pm UTC](https://discuss.elastic.co/t/sysmon-registry-logs-dont-get-to-elastic/374772 "2025-02-19T13:53:36Z")
I'm trying to set up the detection rule called "Privilege Escalation via Windir Environment Variable" but the data that this rule relies upon isn't getting to elastic. I've made sure to have everything set up correctly, … --- ## [Kibana err\_empty\_response from Kibana](https://discuss.elastic.co/t/kibana-err-empty-response-from-kibana/372634)
**Author:** [@douglas\_Garcia](https://discuss.elastic.co/u/douglas_Garcia)\ **Replies:** 1\ **Last updated:** [December 30, 2024, 6:08pm UTC](https://discuss.elastic.co/t/kibana-err-empty-response-from-kibana/372634 "2024-12-30T18:08:14Z")
Hello Team, I have installed on my local machine ES and Kibana to test around I am able to run ES and log in but when it comes to Kibana I have a small issue; I am able to install it and also run the service but when … --- ## [Windows file server files auditing - parsing logs](https://discuss.elastic.co/t/windows-file-server-files-auditing-parsing-logs/371320)
**Author:** [@Adriano\_Trindade](https://discuss.elastic.co/u/Adriano_Trindade)\ **Replies:** 4\ **Last updated:** [December 26, 2024, 8:41pm UTC](https://discuss.elastic.co/t/windows-file-server-files-auditing-parsing-logs/371320 "2024-12-26T20:41:14Z")
Hello everyone! I've set up Windows logs for auditing a Windows file server. File access logs being generated OK. I've deployed a ELK stack in a VM. Configured Winlogbeats on Windows file server OK. Security logs are be… --- ## [Just now downloaded Elasticsearch 8.15.3, Getting the following error](https://discuss.elastic.co/t/just-now-downloaded-elasticsearch-8-15-3-getting-the-following-error/369351)
**Author:** [@ajaytavva](https://discuss.elastic.co/u/ajaytavva)\ **Replies:** 1\ **Last updated:** [October 24, 2024, 10:25pm UTC](https://discuss.elastic.co/t/just-now-downloaded-elasticsearch-8-15-3-getting-the-following-error/369351 "2024-10-24T22:25:47Z")
So, I was getting this error. After the first time I tried running the elasticsearch.bat file Any help is appreciated warning: ignoring JAVA\_HOME=C:\\Program Files\\Java\\jdk-17; using bundled JDK Oct 24, 2024 3:52:55 AM … --- ## [Can't run on win10, An error occurred: java.lang.ClassNotFoundException](https://discuss.elastic.co/t/cant-run-on-win10-an-error-occurred-java-lang-classnotfoundexception/365070)
**Author:** [@cco](https://discuss.elastic.co/u/cco)\ **Replies:** 3\ **Last updated:** [August 18, 2024, 4:21am UTC](https://discuss.elastic.co/t/cant-run-on-win10-an-error-occurred-java-lang-classnotfoundexception/365070 "2024-08-18T04:21:20Z")
I am running Elasticsearch on Windows 10, and I have performed the following operations: C:\\Users\\Win10\\Desktop\\elasticsearch-8.15.0\\bin\>elasticsearch warning: ignoring JAVA\_HOME=C:\\Program Files\\Java\\jdk-22; using bund… --- ## [Windows - Elasticsearch starting with elasticsearch.keystore protected](https://discuss.elastic.co/t/windows-elasticsearch-starting-with-elasticsearch-keystore-protected/363911)
**Author:** [@Jandres84](https://discuss.elastic.co/u/Jandres84)\ **Replies:** 1\ **Last updated:** [July 29, 2024, 2:28pm UTC](https://discuss.elastic.co/t/windows-elasticsearch-starting-with-elasticsearch-keystore-protected/363911 "2024-07-29T14:28:03Z")
I have elasticsearh installed on Windows Server 2016. I have activated the security and some passwords were vaulted in the elasticsearch.keystore file. Then I proceed to protect the keystore using the command elasticsear… --- ## [Defend integration, agent unhealthy, failed install and exist status 213](https://discuss.elastic.co/t/defend-integration-agent-unhealthy-failed-install-and-exist-status-213/363579)
**Author:** [@Adair\_Torres](https://discuss.elastic.co/u/Adair_Torres)\ **Replies:** 1\ **Last updated:** [July 22, 2024, 5:20pm UTC](https://discuss.elastic.co/t/defend-integration-agent-unhealthy-failed-install-and-exist-status-213/363579 "2024-07-22T17:20:58Z")
After the agent was reinstalled on a device, the Elastic Defend integration began showing an error of: "failed install endpoint service ... exit status 213". Which is installation failure from pre-existing files. I've f… --- ## [Looking for document or technical article which explains the Memory Utilization of Java.exe when Elasticsearch is running on Windows server](https://discuss.elastic.co/t/looking-for-document-or-technical-article-which-explains-the-memory-utilization-of-java-exe-when-elasticsearch-is-running-on-windows-server/362354)
**Author:** [@Kalidastate](https://discuss.elastic.co/u/Kalidastate)\ **Replies:** 1\ **Last updated:** [July 2, 2024, 9:09am UTC](https://discuss.elastic.co/t/looking-for-document-or-technical-article-which-explains-the-memory-utilization-of-java-exe-when-elasticsearch-is-running-on-windows-server/362354 "2024-07-02T09:09:49Z")
During extensive testing of Elasticsearch's search functionality, we noticed that the memory utilization of java.exe spikes, causing overall system memory utilization to reach 100%. Despite this, no search failures were … --- ## [Occurrence of NullPointerException and role not assigned when using elasticsearch-users command in Windows](https://discuss.elastic.co/t/occurrence-of-nullpointerexception-and-role-not-assigned-when-using-elasticsearch-users-command-in-windows/361280)
**Author:** [@mousumis](https://discuss.elastic.co/u/mousumis)\ **Replies:** 2\ **Last updated:** [June 16, 2024, 8:07pm UTC](https://discuss.elastic.co/t/occurrence-of-nullpointerexception-and-role-not-assigned-when-using-elasticsearch-users-command-in-windows/361280 "2024-06-16T20:07:12Z")
I am attempting to use the elasticsearch-users.bat utility on a windows machine (Windows Server 2022) to create a user. I am running the following command: elasticsearch-users.bat useradd admin\_user -p "testpassword" -r… --- ## [Logstash Error - Oracle"" was unexpected at this time](https://discuss.elastic.co/t/logstash-error-oracle-was-unexpected-at-this-time/361185)
**Author:** [@asandhu](https://discuss.elastic.co/u/asandhu)\ **Replies:** 3\ **Last updated:** [June 10, 2024, 7:36pm UTC](https://discuss.elastic.co/t/logstash-error-oracle-was-unexpected-at-this-time/361185 "2024-06-10T19:36:51Z")
Hello All I am trying to set up Logstash on my Local to connect to a hosted Elastic instance. Having followed the steps to set up Logstash - I get the following error when trying to run it. I thought I had multiple v… --- ## [Agent unhealthy - Defend - failed install endpoint service - Exit status 213](https://discuss.elastic.co/t/agent-unhealthy-defend-failed-install-endpoint-service-exit-status-213/359198)
**Author:** [@W00glin](https://discuss.elastic.co/u/W00glin)\ **Replies:** 2\ **Last updated:** [May 13, 2024, 2:38pm UTC](https://discuss.elastic.co/t/agent-unhealthy-defend-failed-install-endpoint-service-exit-status-213/359198 "2024-05-13T14:38:07Z")
Hello, Running into this issue across a couple of agents we have in the fleet. Normally when I run into agent issues, I just uninstall and reinstall and the issues are removed. However this issue has been persistent acr… --- ## [Logstash split event messages to different syslog servers](https://discuss.elastic.co/t/logstash-split-event-messages-to-different-syslog-servers/355917)
**Author:** [@Forsaken\_Sherbert\_81](https://discuss.elastic.co/u/Forsaken_Sherbert_81)\ **Replies:** 0\ **Last updated:** [March 21, 2024, 3:11pm UTC](https://discuss.elastic.co/t/logstash-split-event-messages-to-different-syslog-servers/355917 "2024-03-21T15:11:05Z")
Hi all I have an specific use-case scenario were I'm testing out Elastic Agent on windows clients. Some of these logs will be sent to the ELK SIEM for analysis, more debuging and version related information. Other logs… --- ## [Logstash config for windows events](https://discuss.elastic.co/t/logstash-config-for-windows-events/355421)
**Author:** [@deanj](https://discuss.elastic.co/u/deanj)\ **Replies:** 0\ **Last updated:** [March 14, 2024, 3:36pm UTC](https://discuss.elastic.co/t/logstash-config-for-windows-events/355421 "2024-03-14T15:36:22Z")
Hi All, I'm very new to logstash, so i'm new to manually configuring its config for event filtering. What i am planning: 1: Collect windows events. Sent from a remote location by windows event forwarding service on … --- ## [How to know and manage Filbeat writes on Storage Account when ingesting from Event Hubs](https://discuss.elastic.co/t/how-to-know-and-manage-filbeat-writes-on-storage-account-when-ingesting-from-event-hubs/353344)
**Author:** [@rrodrmal](https://discuss.elastic.co/u/rrodrmal)\ **Replies:** 1\ **Last updated:** [March 13, 2024, 2:16pm UTC](https://discuss.elastic.co/t/how-to-know-and-manage-filbeat-writes-on-storage-account-when-ingesting-from-event-hubs/353344 "2024-03-13T14:16:22Z")
Hello, I know this topic seems quite similar to others already created in these forums, but those relate to Logstash instead of Filebeat, so I guess the resolution might be different in this case. We have an ecosystem … --- ## [Error while starting logstash](https://discuss.elastic.co/t/error-while-starting-logstash/354631)
**Author:** [@Dhia\_Said](https://discuss.elastic.co/u/Dhia_Said)\ **Replies:** 7\ **Last updated:** [March 5, 2024, 12:03pm UTC](https://discuss.elastic.co/t/error-while-starting-logstash/354631 "2024-03-05T12:03:26Z")
hello i am new to logstash and i had this error while launching logstash , i didn't know the cause of it, btw i am using it on windows : \[2024-03-04T12:04:49,450\]\[ERROR\]\[logstash.agent \] Failed to execute ac… --- ## [Windows Elastic-Agent Group Deployment](https://discuss.elastic.co/t/windows-elastic-agent-group-deployment/354149)
**Author:** [@Patrick.kirk](https://discuss.elastic.co/u/Patrick.kirk)\ **Replies:** 1\ **Last updated:** [February 26, 2024, 10:18pm UTC](https://discuss.elastic.co/t/windows-elastic-agent-group-deployment/354149 "2024-02-26T22:18:13Z")
I’m looking at doing a mass deployment of the windows elastic agent (1000+ workstations) and looking for a “best or recommend” way. I have not seen an MSI for the agent. What are the recommendations for this? --- ## [Confusion about winlog.process.pid and xcopy](https://discuss.elastic.co/t/confusion-about-winlog-process-pid-and-xcopy/352520)
**Author:** [@nerio](https://discuss.elastic.co/u/nerio)\ **Replies:** 0\ **Last updated:** [February 5, 2024, 10:29am UTC](https://discuss.elastic.co/t/confusion-about-winlog-process-pid-and-xcopy/352520 "2024-02-05T10:29:26Z")
Hello I would have 2 questions : In an event id 1 (pcoess creation), what is the difference between the field winlog.process.pid (eg 2360) and the field process.pid (eg 6392) ? Why did not the command "C:\\Windows\\S… --- ## [Logstash installation batch files v8.11.3 do not work](https://discuss.elastic.co/t/logstash-installation-batch-files-v8-11-3-do-not-work/351306)
**Author:** [@andrew3](https://discuss.elastic.co/u/andrew3)\ **Replies:** 3\ **Last updated:** [January 31, 2024, 8:41pm UTC](https://discuss.elastic.co/t/logstash-installation-batch-files-v8-11-3-do-not-work/351306 "2024-01-31T20:41:43Z")
JRUBY\_BIN: In v8.11.3 SETUP.BAT looks for it in a directory that does not exist in the Windows distribution, causing the "first stash" in the docs. to always fail. Anyone else run across this? Details: In SETUP.BAT lin… --- ## [Configuring Input file on Windows to get Output in 2024](https://discuss.elastic.co/t/configuring-input-file-on-windows-to-get-output-in-2024/351839)
**Author:** [@Will\_J](https://discuss.elastic.co/u/Will_J)\ **Replies:** 2\ **Last updated:** [January 25, 2024, 11:10pm UTC](https://discuss.elastic.co/t/configuring-input-file-on-windows-to-get-output-in-2024/351839 "2024-01-25T23:10:18Z")
I am trying a simple file input / output example. Using following conf file at the C:/logstash-8.11.3-windows-x86\_64/logstash-8.11.3/config/file-pipeline.conf input { file { path =\> \["C:/logstash-8.11.3-wind… --- ## [Elasticsearch 8.11.4 Windows installation from zip not completing](https://discuss.elastic.co/t/elasticsearch-8-11-4-windows-installation-from-zip-not-completing/351172)
**Author:** [@Echo9Zulu](https://discuss.elastic.co/u/Echo9Zulu)\ **Replies:** 5\ **Last updated:** [January 16, 2024, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-11-4-windows-installation-from-zip-not-completing/351172 "2024-01-16T14:40:42Z")
Hello! I am having difficulty installing Elasticsearch 8.11.4 on a laptop running Windows 10. Running elasticsearch.bat creates the following log in the command window. Shortly after running the command the install hang… --- ## [Need Help Monitoring Windows Logs with ELK Stack](https://discuss.elastic.co/t/need-help-monitoring-windows-logs-with-elk-stack/350130)
**Author:** [@qu\_c\_th\_nguy\_n](https://discuss.elastic.co/u/qu_c_th_nguy_n)\ **Replies:** 1\ **Last updated:** [January 12, 2024, 4:59pm UTC](https://discuss.elastic.co/t/need-help-monitoring-windows-logs-with-elk-stack/350130 "2024-01-12T16:59:40Z")
Hey everyone, I'm a newbie trying to figure out how to monitor Windows log events using ELK Stack and Winlogbeat. I've got them installed, but now I'm a bit lost on what to do with all the info. Any advice, tutorials, … --- ## [Elastic Search becomes unresponsive after some time](https://discuss.elastic.co/t/elastic-search-becomes-unresponsive-after-some-time/348311)
**Author:** [@EVINDX](https://discuss.elastic.co/u/EVINDX)\ **Replies:** 2\ **Last updated:** [December 20, 2023, 7:34am UTC](https://discuss.elastic.co/t/elastic-search-becomes-unresponsive-after-some-time/348311 "2023-12-20T07:34:22Z")
We are facing issues with the Elasticsearch in the production environment where Elasticsearch stops responding intermittently and service needs to be restarted in-order to recover from this state. Logs collected from El… --- ## [Elasticsearch first time run hangs adding index template](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169)
**Author:** [@MColeman](https://discuss.elastic.co/u/MColeman)\ **Replies:** 15\ **Last updated:** [December 12, 2023, 7:49pm UTC](https://discuss.elastic.co/t/elasticsearch-first-time-run-hangs-adding-index-template/349169 "2023-12-12T19:49:47Z")
Hi, Using the unzip install method. Unzip, run elasticsearch.bat and it seems to be hanging at \[o.e.c.m.MetadataIndexTemplateService\] adding index template \[logs\] for index patterns \[logs--\] for hours. I was expecting t… --- ## [Logstash CA error](https://discuss.elastic.co/t/logstash-ca-error/348369)
**Author:** [@Marcus\_Berglund](https://discuss.elastic.co/u/Marcus_Berglund)\ **Replies:** 2\ **Last updated:** [November 30, 2023, 8:55pm UTC](https://discuss.elastic.co/t/logstash-ca-error/348369 "2023-11-30T20:55:49Z")
Hi, I have been sitting with this issue all day! :slight\_smile: and I get the below error (on windows) \[2023-11-30T21:42:08,979\]\[ERROR\]\[logstash.outputs.elasticsearch\] Invalid setting for elasticsearch output plugin: … --- ## [Elasticsearch Unable to access 'path.repo' shared folder](https://discuss.elastic.co/t/elasticsearch-unable-to-access-path-repo-shared-folder/346377)
**Author:** [@Aasif\_Ansari](https://discuss.elastic.co/u/Aasif_Ansari)\ **Replies:** 2\ **Last updated:** [November 8, 2023, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-unable-to-access-path-repo-shared-folder/346377 "2023-11-08T10:23:36Z")
Hi Team, I have Elasticsearch installed to my windows server. And I have another windows server with file system shared with the first one. I have map network drive to "I" letter and path "I:\\Elasticsearch-Snapshot-v2" … [Next page](https://discuss.elastic.co/tag/windows/44.md?match_all_tags=true&page=1&tags%5B%5D=windows)