# Winlogbeat not working

**URL:** <https://forum.search-guard.com/t/winlogbeat-not-working/1439>\
**Category:** Search Guard\
**Created:** [April 11, 2019, 2:50pm UTC](https://forum.search-guard.com/t/winlogbeat-not-working/1439 "2019-04-11T14:50:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ekham](https://avatars.discourse-cdn.com/v4/letter/e/ecd19e/32.png) [@Ekham](https://forum.search-guard.com/u/Ekham)\
**Post date:** [April 11, 2019, 2:50pm UTC](https://forum.search-guard.com/t/winlogbeat-not-working/1439/1 "2019-04-11T14:50:41Z")

</div>

**Elasticsearch and Search Guard version : 6.3.2**

**Entreprise Module : Disabled**

**JVM Version : 1.8.0\_111**

**Operating System : Debian 9**

Hello

I have SeachGuard with Kibana and Elasticsearch (No Logstash).  
I also have a winlogbeat agent which do not send anything to my Elasticsearch.

I put this into my winlogbeat file :

output.elasticsearch:  
username: kibanaserver  
password: kibanaserver  
protocol: https  
hosts: [“ip\_address:9200”]  
ssl.certificate\_authorities:  
-C:\Program Files\Winlogbeat\root-ca.cer

As i said before, i didn’t get any entry on kibana discovery.

Can you help me please ?

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [April 11, 2019, 3:19pm UTC](https://forum.search-guard.com/t/winlogbeat-not-working/1439/2 "2019-04-11T15:19:14Z")

</div>

I think you are not using the correct user for running Beats. You have configured:

> [@Ekham](#):
>
> username: kibanaserver  
> password: kibanaserver

The kibanaserver user is only useful for running Kibana.

What you need is a user that has permissions to write to the index that Beats is using. We have just recently published an article about ingestion with Beats and logstash, this should explain the required steps:

> **[Log ingestion with Beats, Logstash and Search Guard](https://search-guard.com/beats-logstash-searchguard/)**
>
> How to configure Search Guard with Elasticsearch log analytics tools like Beats and logstash to protect log data in your cluster.

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [April 11, 2019, 3:19pm UTC](https://forum.search-guard.com/t/winlogbeat-not-working/1439/3 "2019-04-11T15:19:17Z")

</div>

Assigned @jkressin on April 11, 2019, 3:19pm UTC



---

<div class="post-metadata">

**Author:** ![Ekham](https://avatars.discourse-cdn.com/v4/letter/e/ecd19e/32.png) [@Ekham](https://forum.search-guard.com/u/Ekham)\
**Post date:** [April 15, 2019, 1:21pm UTC](https://forum.search-guard.com/t/winlogbeat-not-working/1439/4 "2019-04-15T13:21:15Z")

</div>

Thank you for your reply.

I have tested with the admin account when it ask for Kibana output and elasticsearch output and it works great !

However is there a more suitable account for this task ? I don’t use Logstash so is there an account without “logstash” ?

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [April 16, 2019, 1:26pm UTC](https://forum.search-guard.com/t/winlogbeat-not-working/1439/5 "2019-04-16T13:26:29Z")

</div>

There is no built-in role for a “Beats only” user. However, the setup is pretty straight forward and you can use the sg\_logstash role as a template. Just remove all permissions for the logstash indices and leave everything else in place, like:

```
sg_beats:  
  cluster:
    - CLUSTER_MONITOR
    - CLUSTER_COMPOSITE_OPS
    - indices:admin/template/get
    - indices:admin/template/put
  indices:
    '*beat*':
      '*':
        - CRUD
        - CREATE_INDEX

```

The create a user and map it to the sg\_beats role via the roles mapping.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [May 7, 2019, 1:26pm UTC](https://forum.search-guard.com/t/winlogbeat-not-working/1439/6 "2019-05-07T13:26:36Z")

</div>

Closed on May 7, 2019, 1:26pm UTC

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.