# Graylog Sidecar not sending data

**URL:** <https://community.graylog.org/t/graylog-sidecar-not-sending-data/21387>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, filebeat-linux, filebeat-windows\
**Created:** [October 6, 2021, 4:37pm UTC](https://community.graylog.org/t/graylog-sidecar-not-sending-data/21387 "2021-10-06T16:37:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dani](https://avatars.discourse-cdn.com/v4/letter/d/35a633/32.png) [@dani](https://community.graylog.org/u/dani)\
**Post date:** [October 6, 2021, 4:37pm UTC](https://community.graylog.org/t/graylog-sidecar-not-sending-data/21387/1 "2021-10-06T16:37:31Z")

</div>

## Description of your problem

Graylog is not receiving Windows Event Logs from Graylog Sidecar.

## Description of steps you’ve taken to attempt to solve the issue

- Sidecar is running as service, restarted
- Graylog shows “Running” on Sidecars Overview
- Cleared all Windows logs on endpoint (new log entries are there)
- Sidecar configtest shows “Config OK”
- Sidecar log:

```auto
time="2021-10-06T18:21:17+02:00" level=info msg="Stopping signal distributor" 
time="2021-10-06T18:21:17+02:00" level=info msg="Starting signal distributor" 
time="2021-10-06T18:21:27+02:00" level=info msg="No configurations assigned to this instance. Skipping configuration request.

```

## Environmental information

- Graylog 4.0.5+d95b909 on ubuntu\_1804
- Graylog Collector Sidecar version 1.0.2 (4a6d445) [go1.11.13/amd64]

### Operating system information

- Ubuntu 18.04

### Package versions

- Graylog: 4.0.5+d95b909, codename _Noir_
- MongoDB: v4.0.22
- Elasticsearch: 7.11.2
- Service logs, configuration, and environment variables
- See [the docs site](https://docs.graylog.org/en/latest/pages/configuration/file_location.html) for all file locations

Thanks for hints/help

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [October 6, 2021, 4:48pm UTC](https://community.graylog.org/t/graylog-sidecar-not-sending-data/21387/2 "2021-10-06T16:48:24Z")

</div>

Looks like you haven’t assigned a configuration to the windows machine  
Here is the [step-by-step](https://docs.graylog.org/en/4.1/pages/sidecar.html#step-by-step-guide) guide for sidecar which includes how to assign the configuration.

More specifically it looks like this below… though in this case they are assigning a filebeat config to a linux machine. Once you assign it in the Graylog GUI, Graylog will push the configuration to the Windows machine and the service will restart.

 ![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/637d24bbcfd34162f212e19cbffcae89cf1984f7.png)

On a side note, Elasticsearch is supposed to stay at 7.10 for now ( you are at 7.11.2) You may want to pin it at that version so it doesn’t’ get too far away from you/guidelines.

---

<div class="post-metadata">

**Author:** ![dani](https://avatars.discourse-cdn.com/v4/letter/d/35a633/32.png) [@dani](https://community.graylog.org/u/dani)\
**Post date:** [October 6, 2021, 6:03pm UTC](https://community.graylog.org/t/graylog-sidecar-not-sending-data/21387/3 "2021-10-06T18:03:00Z")

</div>

Thanks, got it working now. I had to stop Graylog for about 3 weeks.  
Somehow that config assignment got lost. I think this should not happen.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 20, 2021, 6:03pm UTC](https://community.graylog.org/t/graylog-sidecar-not-sending-data/21387/4 "2021-10-20T18:03:24Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.