# Filebeat sidecar needs to be restarted on Windows reboot

**URL:** <https://community.graylog.org/t/filebeat-sidecar-needs-to-be-restarted-on-windows-reboot/17735>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, filebeat-windows, winlogbeat\
**Created:** [November 4, 2020, 12:03am UTC](https://community.graylog.org/t/filebeat-sidecar-needs-to-be-restarted-on-windows-reboot/17735 "2020-11-04T00:03:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chench00](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chench00/32/7088_2.png) [@chench00](https://community.graylog.org/u/chench00)\
**Post date:** [November 4, 2020, 12:03am UTC](https://community.graylog.org/t/filebeat-sidecar-needs-to-be-restarted-on-windows-reboot/17735/1 "2020-11-04T00:03:54Z")

</div>

I have Filebeat sidecar configured in Graylog pulling logs from a Windows host and while everything is configured properly, I noticed that once my Windows machine reboots, the sidecar filebeat configuration needs to be restarted (even though it still shows healthy/running) in order for the messages to show in Graylog. As soon as I restart the configuration, I can see all of the messages coming in.

```
# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
   hosts: ["192.168.139.11:5044"]
path:
  data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
  logs: C:\Program Files\Graylog\sidecar\logs
tags:
 - veeam
#filebeat.inputs:
# type: log
# enabled: true
# paths:
# - C:\logs\log.log
filebeat:
  inputs:
    - type: log
      enabled: true
      paths: 
        - C:\logs\log.log      
        - C:\ProgramData\Veeam\Backup\home\Job.home.Backup.log

```

Any help would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [November 4, 2020, 6:43pm UTC](https://community.graylog.org/t/filebeat-sidecar-needs-to-be-restarted-on-windows-reboot/17735/2 "2020-11-04T18:43:21Z")

</div>

So the Graylog Sidecar Windows Services are running, but you need to go to Collectors Administration, select the winlogbeat of the affected server and restart the process? (just being clear of what your current process is)

Check in the logs area for the sidecar, they are very descriptive about what is going on and what is not You have them set to “logs: C:\Program Files\Graylog\sidecar\logs”

If you don’t find helpful details you can post relevant parts of the logs so readers could try and spot issues.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 18, 2020, 6:43pm UTC](https://community.graylog.org/t/filebeat-sidecar-needs-to-be-restarted-on-windows-reboot/17735/3 "2020-11-18T18:43:26Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.