Graylog 3, Sidecar (1.0.1) WinLogEvt - No messages

Hi guys:
Having an issue with Graylog 3.0.1 and a Windows Server 2012 running Sidecar 1.0.1.
Sidecar registered and FileBeat config gets pushed out with no issues:

Content of winlogbeat.yml (generated folder) in Win Server:

Needed for Graylog

fields_under_root: true
fields.collector_node_id: anms-dc01
fields.gl2_source_collector: 5a51f09b-69d5-4f15-8f26-280ce46f6d67

hosts: [“”]
data: C:\Program Files\Graylog\sidecar\cache\winlogbeat\data
logs: C:\Program Files\Graylog\sidecar\logs

  • windows
    • name: Application
    • name: System
    • name: Security

Input also configured in Graylog server:

However, I see no messages, either via Systems - Sidecars - Show messages or directly from Input.

TCPDump run on Graylogserver and on WinServer show traffic on TCP 9000 but no conns at all on port 5055.

I’d been using “old” sidecar collectors and Graylog 2.x for a while with no issues but I don’t seem to get this one working.

Any ideas?


Also, the Backend Log File throws following entries:

2019-05-02T22:42:50.792-0700 ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp:// dial tcp connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2019-05-02T22:42:50.792-0700 INFO pipeline/output.go:93 Attempting to reconnect to backoff(async(tcp:// with 8 reconnect attempt(s)

No local FW running on Graylog Server. A telnet from WinServer to Graylog on port 5045 works.


In screenshots Graylog server address is, in winlogbeat configuration it is


Thanks Karlis, I guess I need a new pair of glasses.


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.