# Cannot make this work

**URL:** <https://discuss.elastic.co/t/cannot-make-this-work/276090>\
**Category:** Elasticsearch\
**Created:** [June 16, 2021, 7:12am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090 "2021-06-16T07:12:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peque](https://avatars.discourse-cdn.com/v4/letter/p/f475e1/32.png) [@Peque](https://discuss.elastic.co/u/Peque)\
**Post date:** [June 16, 2021, 7:12am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090/1 "2021-06-16T07:12:34Z")

</div>

Hi Group  
I struggling like H\*\*\* t omake this work

I have created an ELK server on Ubuntu 20.04LTS - and would like to monitor both Normal Linux/Windows Server - and allso our PFsense Routers.  
I'm using the PFELK --\> [GitHub - pfelk/pfelk: pfSense/OPNsense + ELK](https://github.com/pfelk/pfelk) to monitor our PFsense

But its like I cannot have both setups running at the same time! and the questions is why

Is it that both default uses Filebeat as the data collector - and can not make it work  
Seperatly If I create an install for normal machines - this work  
Allso installing pfelk as single install - is working

But when I using Both at the same time - I'm only getting information from PFsense - not all other PC - there just no data after the PFelk is installed

What is my problem here

Thanks in advance  
P

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 17, 2021, 1:52am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090/2 "2021-06-17T01:52:52Z")

</div>

When you are using pfelk and other Filebeat instances, what happens exactly? What is the config setup as and what do the logs of Filebeat show?

---

<div class="post-metadata">

**Author:** ![Peque](https://avatars.discourse-cdn.com/v4/letter/p/f475e1/32.png) [@Peque](https://discuss.elastic.co/u/Peque)\
**Post date:** [June 17, 2021, 8:35am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090/3 "2021-06-17T08:35:22Z")

</div>

Well in this case - I'm following this guide --\> [How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on Ubuntu 20.04 | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-20-04)  
Configured as described in the guide

Than all logs files from other machines are sending to the ELK server  
Then I do the Installation for PFsense - using this guide --\> [GitHub - pfelk/pfelk: pfSense/OPNsense + ELK](https://github.com/pfelk/pfelk)  
Using the Script for installing. no errors or reinstallation of the packages

And then afterwards I'm logging from PFsense - But not from all other machines!  
My guess is that PFELK overrules the filebeat setup and therefor only see the PFELK solutions

Asking about config setup - I haven't done anything else other that what the guides describes.  
There was data before installing PFelk - in this

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8ee17eb0cbdc6505e0133361ea01f2bdac482cbf.png)  
After installing PFELK it'll just show the above image - and no data are getting to the ELK server from Servers

a Restart of filebeat gives me this logfile:

> **[Jun 17 08:21:08 app-srv06 filebeat\[2304\]:...](https://pastebin.com/w46UMtL9)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

It'll shoiw active status when using systemctl

The exact thing that goes wrong - is when I'm using their automatic installation, All indexes setup before runnign the script - and trhen just showing no information are noticed for filebeat index!  
But I not sure where this error are created -. Which files would you like to see - since I'm getting lost when I look through the fiules and which configuration are you interested in

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2021, 2:36am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090/4 "2021-06-18T02:36:29Z")

</div>

I had a look at [pfelk/ubuntu.md at main · pfelk/pfelk · GitHub](https://github.com/pfelk/pfelk/blob/main/install/ubuntu.md), as the install script is a bit much to pull apart, and it does overwrite things in Logstash and Kibana, so it's likely that is the cause of the issue.

---

<div class="post-metadata">

**Author:** ![Peque](https://avatars.discourse-cdn.com/v4/letter/p/f475e1/32.png) [@Peque](https://discuss.elastic.co/u/Peque)\
**Post date:** [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090/5 "2021-06-18T05:13:28Z")

</div>

So I cannot see where and why it goes wrong - as I see it, So I cannot figure out where the issue is in this setup - but It should be possible to make this work

But I cannot figure out why !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2021, 5:14am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090/6 "2021-07-16T05:14:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
