# Problem with filebeat configuration on Windows
**URL:** https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991
**Category:** Graylog Central (peer support)
**Tags:** filebeat-linux, filebeat-windows, winlogbeat, sidecar
**Created:** [April 17, 2019, 8:42am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991 "2019-04-17T08:42:44Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@schurd](https://community.graylog.org/u/schurd)
#### Post date: [April 17, 2019, 8:42am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/1 "2019-04-17T08:42:44Z")
Hello,
I struggle to create a working filebeat configuration for Windows.
The configuration of the sidcar is:
# Needed for Graylog
fields\_under\_root: false
fields.collector\_node\_id: {sidecar.nodeName} fields.gl2\_source\_collector: {sidecar.nodeId}
```
filebeat:
prospectors:
- encoding: plain
ignore_older: 0
paths:
- C:\Program Files\Graylog\sidecar\logs\sidecar.log
scan_frequency: 10s
tail_files: true
type: log
output:
logstash:
hosts: ["node1:5044","node2:5044"]
loadbalance: true
path:
data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
logs: C:\Program Files\Graylog\sidecar\logs
tags:
- windows
```
Once deployed to Windows I get the error:
Error Details for filebeat\_win
Exiting: error loading config file: open C:\Program: Das System kann die angeebene Datei nicht finden.
What might be the error her. Winlogbeat runs fine on the same system.
Graylog: 3.0.1
ES: 6.7.1
Thanks in advance
Dietmar
---
### Author:  [@Karlis](https://community.graylog.org/u/Karlis)
#### Post date: [April 17, 2019, 10:56am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/2 "2019-04-17T10:56:28Z")
All paths must be in quotes, since they contain spaces.
paths: - “C:\Program Files\Graylog\sidecar\logs\sidecar.log”
---
### Author:  [@schurd](https://community.graylog.org/u/schurd)
#### Post date: [April 17, 2019, 11:57am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/3 "2019-04-17T11:57:09Z")
Hello Karlis,
yes, I tried this, but I still get the same error message.
I my effort to do more debugging I found out, that the sidecar says in the sidecar.log:
```
time="2019-04-17T13:48:15+02:00" level=info msg="[filebeat_win] Configuration change detected, rewriting configuration file."
time="2019-04-17T13:48:15+02:00" level=error msg="[filebeat_win] Collector configuration file is not valid, waiting for the next update."
time="2019-04-17T13:48:15+02:00" level=error msg="[filebeat_win] Validation command output: Exiting: error loading config file: open C:\\Program: Das System kann die angegebene Datei nicht finden.\n"
```
But when I test the filebeat config directly I get this:
```
C:\Program Files\Graylog\sidecar>filebeat.exe test config -c generated\filebeat_win.conf
Config OK
```
That’s somehow strange. **Filebeat** tells me the configuration is ok, but **sidecar** tells me the configuration is broken.
Do you know which setting ist correkt for “Process Management” for filebeat?
Is it “foreground execution” or “Windows service”?
Regards,
Dietmar
---
### Author:  [@Karlis](https://community.graylog.org/u/Karlis)
#### Post date: [April 17, 2019, 12:19pm UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/4 "2019-04-17T12:19:41Z")
> [@schurd](#):
>
> Do you know which setting ist correkt for “Process Management” for filebeat?
> Is it “foreground execution” or “Windows service”?
>
---
### Author:  [@Karlis](https://community.graylog.org/u/Karlis)
#### Post date: [April 17, 2019, 12:25pm UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/5 "2019-04-17T12:25:58Z")
Once again, that error _can’t open C:\Program_ tells, somewhere in configuration the path “C:\Program Files\blah…” are not enclosed in quotes.
---
### Author:  [@schurd](https://community.graylog.org/u/schurd)
#### Post date: [April 17, 2019, 12:39pm UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/6 "2019-04-17T12:39:48Z")
Hello Karlis,
thanks for the hint. But somehow sidecar itself can’t find the filebeat configuration file. I am using Sidecar 1.0.1.
If I run filebeat from the command line, it works and I receive messages in Graylog like expected:
`C:\Program Files\Graylog\sidecar>filebeat.exe -c "C:\\Program Files\\Graylog\\sidecar\\generated\\filebeat_win.conf"`
But wiht sidecart I get always the error. I checked all the quotes, they are all right.
Therefore I uncommented in sidecar.yml the line:
`collector_configuration_directory: "C:\\Program Files\\Graylog\\sidecar\\generated"`
But without success. Still, sidecar can’t find the filebeat config file.
By the way, winlogbeat works fine on the same windows machine.
Here the filebeat configuration:
```
fields_under_root: false
fields.collector_node_id: GVC0093001
fields.gl2_source_collector: e85f470e-2ae6-4d34-bee6-139ae82de70a
filebeat.inputs:
- type: log
paths:
- "C:\\Program Files\\Graylog\\sidecar\\logs\\sidecar.log"
scan_frequency: 10s
tail_files: true
output:
logstash:
hosts: ["node1:5045","node2:5045"]
loadbalance: true
path:
data: C:\\Program Files\\Graylog\\sidecar\\cache\\filebeat\\data
logs: C:\\Program Files\\Graylog\\sidecar\\logs
tags:
- windows
```
Thanks in advance for your help.
Regards,
Dietmar
---
### Author:  [@Karlis](https://community.graylog.org/u/Karlis)
#### Post date: [April 17, 2019, 1:58pm UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/7 "2019-04-17T13:58:58Z")
Quotes should be also here:
path:
data: “C:\Program Files\Graylog\sidecar\cache\filebeat\data”
logs: “C:\Program Files\Graylog\sidecar\logs”
---
### Author:  [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)
#### Post date: [April 17, 2019, 8:13pm UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/8 "2019-04-17T20:13:49Z")
Try putting `"` (quotes) around the path name, e.g. `"C:\Program Files\Graylog\sidecar\cache\filebeat\data"` and see if that fixes it.
---
### Author:  [@schurd](https://community.graylog.org/u/schurd)
#### Post date: [April 18, 2019, 6:41am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/9 "2019-04-18T06:41:48Z")
Hell Ben,
thanks for your help.
I tried with quotes, but the error still is the same.
What puzzles me is, that in the winlogbeat.conf it works without quotes.
Secondly the filebeat test config command returns “Syntax OK” like I wrote in a previous message.
So, obviously the sidecar config check returns an error, but the filebeat config check returns a “Syntax OK”.
So, may be, I have a problem with the sidecar.yml configuration.
In the sidecar.yml I defined configuration directory with this line:
collector\_configuration\_directory: “C:\Program Files\Graylog\sidecar\generated”
Is it possible, that the sidecar configuration check is getting something wrong here?
How can I debug further the sidecar?
Thanks in advance,
Dietmar
---
### Author:  [@marius](https://community.graylog.org/u/marius)
#### Post date: [April 18, 2019, 12:39pm UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/10 "2019-04-18T12:39:41Z")
Hey Dietmar,
because the validation command is obviously not working could you please share the setting “Parameters for Configuration Validation” in the “Log Collectors” section for both beats?
It should be: test config -c “%s”
So the path to the configuration file is quoted there as well.
Regards,
Marius
---
### Author:  [@schurd](https://community.graylog.org/u/schurd)
#### Post date: [April 23, 2019, 5:09am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/11 "2019-04-23T05:09:51Z")
Hello Marius,
thanks for the hint. I am now out of office. Next week I will be back and will check the mentioned setting.
But I simply copied the setting from winlogbeat. May be that was wrong.
Regards,
Dietmar
---
### Author:  [@schurd](https://community.graylog.org/u/schurd)
#### Post date: [April 29, 2019, 7:08am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/12 "2019-04-29T07:08:27Z")
Hello Marius,
yes, looks like this solves the problem.
The parameter for config validation was:
`test config -c %s`
because I simply copied it from the filebeat for Linux Collector configuration.
With quotes it works!!
May be you can improve the documentation, so the difference between Linux and Windows in the Log Collector configuration is obvious.
Thank you very much for your help!
Regards,
Dietmar
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [May 13, 2019, 7:08am UTC](https://community.graylog.org/t/problem-with-filebeat-configuration-on-windows/9991/13 "2019-05-13T07:08:29Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.