This is a cache of https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-script.html. It is a snapshot of the page at 2025-09-25T05:37:20.574+0000.
Windows Installation Script | Winlogbeat Reference [8.19] | Elastic
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Windows Installation Script

edit

The installation script, install-service-winlogbeat.ps1 is responsible for creating the Windows Service for Winlogbeat. Starting in 8.19.3, the base folder has changed from C:\ProgramData\ to C:\Program Files\ because the latter has stricter permissions, therefore the home path (base for state and logs) is now C:\Program Files\Winlogbeat-Data.

The install script (install-service-winlogbeat.ps1) will check whether C:\ProgramData\winlogbeat exits and attempt to move it to C:\Program Files\Winlogbeat-Data. If an error occurs, the script will stop and print the error.

On success, it will create the Windows Service setting:

  • path.home as $env:ProgramFiles\Winlogbeat-Data
  • path.logs as $env:ProgramFiles\Winlogbeat-Data\logs

The script also supports passing the parameter -ForceLegacyPath to use the old default C:\ProgramData\ that is set using $env:PROGRAMDATA. However using -ForceLegacyPath is not recommended.

In a PowerShell prompt, can use Get-Help install-service-winlogbeat.ps1 -detailed to get detailed help.

Troubleshooting

edit

If there is a permission error when the installation script is moving the folder, ensure the user running the script has enough permissions to do so. If the problem persists, the folder can be moved manually, then the installation script can be executed again.

If the script still cannot move the files, you can manually move C:\ProgramData\winlogbeat to C:\Program Files\Winlogbeat-Data. and run the install script again.