# Running Filebeat in Windows

Running Filebeat on Windows is straightforward. Filebeat is available as a native Windows service, and you can follow these steps to install and configure it:

### **1. Download Filebeat**

1. Go to the [Elastic Downloads page](https://www.elastic.co/downloads/beats/filebeat).
2. Download the Windows `.zip` file for Filebeat.

### **2. Install Filebeat**

1. **Extract the Zip File:**
    - Extract the contents of the `.zip` file to a directory of your choice, such as `C:\\Program Files\\Filebeat`.
2. **Configure Filebeat:**
    - Navigate to the extracted directory.
    - Open the `filebeat.yml` configuration file in a text editor.
    
    Example configuration for Filebeat:
    
    ```yaml
    filebeat.inputs:
      - type: log
        paths:
          - C:\\path\\to\\your\\log\\files\\*.log
    
    output.elasticsearch:
      hosts: ["<http://localhost:9200>"]
    ```
    
    Modify the `paths` to point to the location of your log files and `hosts` to your Elasticsearch instance.
    

### **3. Install Filebeat as a Windows Service**

1. Open a Command Prompt with Administrator privileges.
2. Navigate to the Filebeat installation directory.
3. Run the following command to install Filebeat as a service:
    
    ```bash
    filebeat.exe install
    ```
    

### **4. Start the Filebeat Service**

1. Still in the Command Prompt with Administrator privileges, start the Filebeat service:
    
    ```bash
    filebeat.exe start
    ```
    
    You can also use the Services management console (`services.msc`) to start and stop the Filebeat service.
    

### **5. Verify Installation**

1. Check the status of Filebeat to ensure it’s running correctly:
    
    ```bash
    filebeat.exe status
    ```
    
2. Monitor the logs for any errors or issues. Log files are typically located in `C:\\Program Files\\Filebeat\\logs`.

### **6. Optional: Configure Logging and Debugging**

1. To enable debug logging, modify the `filebeat.yml` configuration file:
    
    ```yaml
    logging.level: debug
    ```
    
2. Restart the Filebeat service to apply the changes:
    
    ```bash
    filebeat.exe restart
    ```
    

### **7. Troubleshooting**

- **Check Filebeat Logs:** Review the Filebeat logs for any errors or warnings. Logs can be found in the `logs` directory of the Filebeat installation.
- **Firewall and Network Issues:** Ensure that there are no firewall rules blocking Filebeat from sending data to Elasticsearch or Logstash.

By following these steps, you should have Filebeat up and running on your Windows system, collecting and forwarding logs as configured.