D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86>.\winlogbeat.exe -c .\winlogbeat.yml -configtest -e 2016/11/23 17:47:09.813554 beat.go:264: INFO Home path: [D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86] Config path: [D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86] Data path: [D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86\data] Logs path: [D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86\logs] 2016/11/23 17:47:09.813554 beat.go:174: INFO Setup Beat: winlogbeat; Version: 5.0.1 2016/11/23 17:47:09.813554 logp.go:219: INFO Metrics logging every 30s 2016/11/23 17:47:09.813554 logstash.go:90: INFO Max Retries set to: 3 2016/11/23 17:47:09.829198 outputs.go:100: ERR failed to initialize logstash plugin as output: missing required field accessing 'output.logstash.hosts' 2016/11/23 17:47:09.829198 beat.go:285: CRIT Exiting: error initializing publisher: missing required field accessing 'output.logstash.hosts' Exiting: error initializing publisher: missing required field accessing 'output.logstash.hosts' D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86> D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86>winlogbeat.exe Exiting: error initializing publisher: missing required field accessing 'output.logstash.hosts' D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86>.\winlogbeat.exe -c .\winlogbeat.yml Exiting: error initializing publisher: missing required field accessing 'output.logstash.hosts' D:\Documents and Settings\administrator.PENTASEC.000\My Documents\winlogbeat-5.0.1-windows-x86>.\winlogbeat.exe -c .\winlogbeat.yml Exception 0xc0000005 0x0 0x544e4550 0x7c837f9f PC=0x7c837f9f syscall.Syscall9(0x77e4f871, 0x7, 0x2800, 0x34f10001, 0x1647, 0x0, 0x11b02000, 0x8000, 0x11db755c, 0x0, ...) /usr/local/go/src/runtime/syscall_windows.go:185 +0x4a github.com/elastic/beats/winlogbeat/sys/eventlogging._FormatMessage(0x2800, 0x34f10001, 0x1647, 0x0, 0x11b02000, 0x8000, 0x11db755c, 0x1, 0x0, 0x0) /go/src/github.com/elastic/beats/winlogbeat/sys/eventlogging/zsyscall_windows.go:75 +0x97 github.com/elastic/beats/winlogbeat/sys/eventlogging.formatMessage(0x11db7550, 0x8, 0x1647, 0x0, 0x11db755c, 0x1, 0x1, 0x11b02000, 0x10000, 0x10000, ...) /go/src/github.com/elastic/beats/winlogbeat/sys/eventlogging/eventlogging_windows.go:210 +0x49a github.com/elastic/beats/winlogbeat/sys/eventlogging.RenderEvents(0x11c04000, 0x7ff88, 0x7ffff, 0x0, 0x11b02000, 0x10000, 0x10000, 0x11ded768, 0x0, 0x0, ...) /go/src/github.com/elastic/beats/winlogbeat/sys/eventlogging/eventlogging_windows.go:155 +0x793 github.com/elastic/beats/winlogbeat/eventlog.(*eventLogging).Read(0x11eb66c0, 0x0, 0x0, 0x0, 0x0, 0x0) /go/src/github.com/elastic/beats/winlogbeat/eventlog/eventlogging.go:152 +0x564 github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).processEventLog(0x11a70d20, 0x11ebe5c0, 0xb04000, 0x11eb66c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:207 +0x322 created by github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).Run /go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:158 +0x333 goroutine 1 [semacquire, 1 minutes]: sync.runtime_Semacquire(0x11ebe5cc) /usr/local/go/src/runtime/sema.go:47 +0x26 sync.(*WaitGroup).Wait(0x11ebe5c0) /usr/local/go/src/sync/waitgroup.go:131 +0xa4 github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).Run(0x11a70d20, 0x11b6e240, 0x0, 0x0) /go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:161 +0x35d github.com/elastic/beats/libbeat/beat.(*Beat).launch(0x11b6e240, 0x954e94, 0x0,0x0) /go/src/github.com/elastic/beats/libbeat/beat/beat.go:208 +0x87b github.com/elastic/beats/libbeat/beat.Run(0x900c8a, 0xa, 0x0, 0x0, 0x954e94, 0x0, 0x0) /go/src/github.com/elastic/beats/libbeat/beat/beat.go:133 +0x57 main.main() /go/src/github.com/elastic/beats/winlogbeat/main.go:21 +0x40 goroutine 37 [syscall, 1 minutes]: os/signal.signal_recv(0x0) /usr/local/go/src/runtime/sigqueue.go:116 +0x11e os/signal.loop() /usr/local/go/src/os/signal/signal_unix.go:22 +0x1a created by os/signal.init.1 /usr/local/go/src/os/signal/signal_unix.go:28 +0x36 goroutine 39 [select]: github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor.func1(0x11eba180, 0x11eba150) /go/src/github.com/elastic/beats/libbeat/common/cache.go:219 +0xd3 created by github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor /go/src/github.com/elastic/beats/libbeat/common/cache.go:227 +0x8f goroutine 26 [chan receive]: github.com/elastic/beats/libbeat/logp.logExpvars(0x11b6e2c0) /go/src/github.com/elastic/beats/libbeat/logp/logp.go:224 +0x15d created by github.com/elastic/beats/libbeat/logp.Init /go/src/github.com/elastic/beats/libbeat/logp/logp.go:137 +0x371 goroutine 27 [select]: github.com/elastic/beats/libbeat/publisher.(*messageWorker).run(0x11a70c60) /go/src/github.com/elastic/beats/libbeat/publisher/worker.go:63 +0x1c3 created by github.com/elastic/beats/libbeat/publisher.(*messageWorker).init /go/src/github.com/elastic/beats/libbeat/publisher/worker.go:57 +0xff goroutine 28 [select]: github.com/elastic/beats/libbeat/publisher.(*bulkWorker).run(0x11a6d700) /go/src/github.com/elastic/beats/libbeat/publisher/bulk.go:54 +0x284 created by github.com/elastic/beats/libbeat/publisher.newBulkWorker /go/src/github.com/elastic/beats/libbeat/publisher/bulk.go:42 +0x1da goroutine 49 [select]: github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor.func1(0x11a70e70,0x11a70e40) /go/src/github.com/elastic/beats/libbeat/common/cache.go:219 +0xd3 created by github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor /go/src/github.com/elastic/beats/libbeat/common/cache.go:227 +0x8f goroutine 42 [select]: github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor.func1(0x11eba300,0x11eba2d0) /go/src/github.com/elastic/beats/libbeat/common/cache.go:219 +0xd3 created by github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor /go/src/github.com/elastic/beats/libbeat/common/cache.go:227 +0x8f goroutine 43 [chan receive, 1 minutes]: github.com/elastic/beats/libbeat/service.HandleSignals.func1(0x11ec0600, 0x11ebe4a0, 0x11ebe490) /go/src/github.com/elastic/beats/libbeat/service/service.go:29 +0x31 created by github.com/elastic/beats/libbeat/service.HandleSignals /go/src/github.com/elastic/beats/libbeat/service/service.go:32 +0x158 goroutine 44 [chan receive, 1 minutes]: github.com/elastic/beats/libbeat/service.(*beatService).Execute(0xb36738, 0x11a7c198, 0x1, 0x1, 0x11a72140, 0x11a72180, 0x11aebb00, 0x0) /go/src/github.com/elastic/beats/libbeat/service/service_windows.go:23 +0xda github.com/elastic/beats/vendor/golang.org/x/sys/windows/svc/debug.Run(0x11a756c0, 0x10, 0xb002c0, 0xb36738, 0x0, 0x0) /go/src/github.com/elastic/beats/vendor/golang.org/x/sys/windows/svc/debug/service.go:40 +0x14b github.com/elastic/beats/libbeat/service.ProcessWindowsControlEvents(0x11ebe4c0) /go/src/github.com/elastic/beats/libbeat/service/service_windows.go:57 +0x19a created by github.com/elastic/beats/libbeat/service.HandleSignals /go/src/github.com/elastic/beats/libbeat/service/service.go:38 +0x1b6 goroutine 5 [select, 1 minutes]: github.com/elastic/beats/vendor/golang.org/x/sys/windows/svc/debug.Run.func1(0x11a721c0, 0x11a72140, 0x11a72180) /go/src/github.com/elastic/beats/vendor/golang.org/x/sys/windows/svc/debug/service.go:32 +0x14c created by github.com/elastic/beats/vendor/golang.org/x/sys/windows/svc/debug.Run /go/src/github.com/elastic/beats/vendor/golang.org/x/sys/windows/svc/debug/service.go:38 +0xd2 goroutine 45 [select]: github.com/elastic/beats/winlogbeat/checkpoint.(*Checkpoint).run(0x11ec41c0) /go/src/github.com/elastic/beats/winlogbeat/checkpoint/checkpoint.go:114 +0x327 created by github.com/elastic/beats/winlogbeat/checkpoint.NewCheckpoint /go/src/github.com/elastic/beats/winlogbeat/checkpoint/checkpoint.go:99+0x433 goroutine 46 [sleep]: time.Sleep(0x3b9aca00, 0x0) /usr/local/go/src/runtime/time.go:59 +0xd4 github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).processEventLog(0x11a70d20, 0x11ebe5c0, 0xb04000, 0x11eb6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:216 +0x5d2 created by github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).Run /go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:158 +0x333 goroutine 47 [syscall, locked to thread]: syscall.Syscall9(0x7d1fb18d, 0x7, 0x0, 0x132339f0, 0x1264dc70, 0x0, 0x1264de30,0x11df3670, 0x11a3c2d0, 0x0, ...) /usr/local/go/src/runtime/syscall_windows.go:185 +0x4a github.com/elastic/beats/vendor/golang.org/x/sys/windows.LookupAccountSid(0x0, 0 x12319180, 0x11d02230, 0x11df366c, 0x11d02310, 0x11df3670, 0x11df36c4, 0x0, 0x0 /go/src/github.com/elastic/beats/vendor/golang.org/x/sys/windows/zsyscall_windows.go:2116 +0xc7 github.com/elastic/beats/vendor/golang.org/x/sys/windows.(*SID).LookupAccount(0x123192e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0) /go/src/github.com/elastic/beats/vendor/golang.org/x/sys/windows/security_windows.go:246 +0x197 github.com/elastic/beats/winlogbeat/sys.PopulateAccount(0x11df385c, 0x0, 0x0) /go/src/github.com/elastic/beats/winlogbeat/sys/sid_windows.go:17 +0x88 github.com/elastic/beats/winlogbeat/eventlog.(*eventLogging).Read(0x11eb6360, 0x0, 0x0, 0x0, 0x0, 0x0) /go/src/github.com/elastic/beats/winlogbeat/eventlog/eventlogging.go:164 +0x7e2 github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).processEventLog(0x11a70d20, 0x11ebe5c0, 0xb04000, 0x11eb6360, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...) /go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:207 +0x322 created by github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).Run /go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:158 +0x333 goroutine 81 [chan receive, locked to thread]: net.(*ioSrv).ProcessRemoteIO(0x11a53ac8) /usr/local/go/src/net/fd_windows.go:127 +0xcc created by net.startServer /usr/local/go/src/net/fd_windows.go:227 +0xc9 goroutine 82 [chan receive, locked to thread]: net.(*ioSrv).ProcessRemoteIO(0x11a53ad0) /usr/local/go/src/net/fd_windows.go:127 +0xcc created by net.startServer /usr/local/go/src/net/fd_windows.go:229 +0x11e eax 0x544e4550 ebx 0x33070073 ecx 0x7 edx 0x7ffffffe edi 0x20 esi 0x2 ebp 0x3307f77c esp 0x3307f310 eip 0x7c837f9f eflags 0x10202 cs 0x1b fs 0x3b gs 0x0