Start Winlogbeat [winlogbeat-starting]

Before starting Winlogbeat:

• Follow the steps in Quick start: installation and configuration to install, configure, and set up the Winlogbeat environment.
• Make sure {{kib}} and {{es}} are running.
• Make sure the user specified in winlogbeat.yml is authorized to publish events.

To start Winlogbeat, run:

PS C:\Program Files\Winlogbeat> Start-Service winlogbeat

Winlogbeat should now be running. If you used the logging configuration described here, you can view the log file at C:\Program Files\winlogbeat-Data\Logs.

By default Windows log files are stored in C:\Program Files\Winlogbeat-Data\logs.

:::{note} In versions before 9.0.6, the default location for Windows log files was C:\ProgramData\winlogbeat\logs. :::

You can view the status of the service and control it from the Services management console in Windows. To launch the management console, run this command:

PS C:\Program Files\Winlogbeat> services.msc