Install and run Filebeat on Windows

Configure a Windows filestream input, authenticate to Elasticsearch, install the Filebeat service, and verify its logs and state paths.

Guance Editorial Team 2026-10-27 3 min read Updated 2026-10-27

Best practices

Download the Windows ZIP distribution of Filebeat, extract it to a directory such as C:\Program Files\Filebeat, configure filebeat.yml, and run the supplied service installation script from an elevated PowerShell window.

1. Download and extract

Use Elastic's distribution for the intended version and architecture. Paths under Program Files contain spaces, so quote them in PowerShell commands.

2. Configure the input and output

filebeat.inputs:
  - type: filestream
    id: myapp-files
    paths:
      - 'C:\logs\myapp\*.log'

output.elasticsearch:
  hosts: ["https://es.example.com:9200"]
  api_key: "${ES_API_KEY}"
  ssl.certificate_authorities: ['C:\Program Files\Filebeat\certs\http_ca.crt']

Replace the endpoint and CA file with verified values. Supply a suitably scoped API key through the Filebeat keystore or a controlled environment accessible to the service. Your interactive PowerShell environment is not necessarily the service environment.

Give each filestream input a unique, stable ID. Single-quoted YAML paths keep Windows backslashes literal; double-quoted paths require escaping.

3. Validate and install the service

In an elevated PowerShell window:

Set-Location "C:\Program Files\Filebeat"
.\filebeat.exe test config -e
.\filebeat.exe test output -e
.\install-service-filebeat.ps1
Start-Service filebeat

Review the validation results before starting the service. If script execution is restricted, verify the download and follow the organization's execution policy; use an approved process-scoped allowance rather than permanently weakening user or machine policy.

Inspect the running service

Get-Service filebeat
Get-Content "C:\Program Files\Filebeat-Data\logs\filebeat*" -Tail 50

Recent installation scripts use C:\Program Files\Filebeat-Data for state and logs. Older versions may use C:\ProgramData\filebeat. Check the installed version and the service's path.logs and path.data arguments instead of assuming the binary directory contains them.

Troubleshoot common failures

Symptom	Check
Service does not start	Run `.\filebeat.exe -c filebeat.yml -e` in the foreground after stopping the service; account permissions and service paths may differ
No documents arrive	Verify the path glob, file access, input state, and output errors; some filestream fingerprint settings delay reading very small files
Connection fails	Check endpoint, port, TLS trust, authentication, and outbound firewall policy
Files are collected again	Check whether the registry/state directory or input identity changed; do not delete state casually

FAQ

Should I use Filebeat or Logstash on Windows?

Filebeat focuses on collecting and forwarding events. Logstash supports more extensive processing with a different resource footprint. A common pipeline is Filebeat → Logstash → Elasticsearch; Filebeat can also send directly to Elasticsearch and use ingest pipelines. Choose based on the processing and operational requirements.

Can filestream collect Windows Event Logs?

No: filestream reads files. Use a supported Windows Event Log input or integration, commonly Winlogbeat or Elastic Agent. Do not paste Winlogbeat's event_logs configuration into a Filebeat filestream input.

How do I uninstall it?

Stop the service, run the supplied uninstall script, and remove the installation when it is no longer needed:

Stop-Service filebeat
.\uninstall-service-filebeat.ps1

If a service registration remains, sc.exe delete filebeat is the Windows service-control command; sc alone can be a PowerShell alias. Retain state data until you have decided whether resuming collection or rolling back is necessary.

References: Elastic installation guide, filestream input.