# Cannot start filebeat 7.6 **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 16, 2020, 3:22am UTC](https://discuss.elastic.co/t/cannot-start-filebeat-7-6/223682 "2020-03-16T03:22:40Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Ding\_Huiyang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ding_huiyang/32/64470_2.png) [@Ding\_Huiyang](https://discuss.elastic.co/u/Ding_Huiyang)\ **Post date:** [March 16, 2020, 3:22am UTC](https://discuss.elastic.co/t/cannot-start-filebeat-7-6/223682/1 "2020-03-16T03:22:40Z")
I want to install filebeat, and connect it to [logz.io](http://logz.io) After following the set up for the filebeat.yml, my filebeat could not be started. I am getting error: ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/6/6/6685cbec76e964b00d23300bad756969efecfd8b.png) ● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Sun 2020-03-15 23:21:00 EDT; 4s ago Docs: [https://www.elastic.co/products/beats/filebeat](https://www.elastic.co/products/beats/filebeat) Process: 3890 ExecStart=/usr/share/filebeat/bin/filebeat $BEAT\_LOG\_OPTS $BEAT\_CONFIG\_OPTS $BEAT\_PATH\_OPTS (code=exited, status=1/FAILURE) Main PID: 3890 (code=exited, status=1/FAILURE) Mar 15 23:21:00 hamilton-VirtualBox systemd[1]: filebeat.service: Service hold-off time over, scheduling restart. Mar 15 23:21:00 hamilton-VirtualBox systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5. Mar 15 23:21:00 hamilton-VirtualBox systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch.. Mar 15 23:21:00 hamilton-VirtualBox systemd[1]: filebeat.service: Start request repeated too quickly. Mar 15 23:21:00 hamilton-VirtualBox systemd[1]: filebeat.service: Failed with result 'exit-code'. Mar 15 23:21:00 hamilton-VirtualBox systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch.. Here is my yml file: (Based on: [https://docs.logz.io/shipping/log-sources/zeek.html](https://docs.logz.io/shipping/log-sources/zeek.html)) filebeat.inputs: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/e/ee4ca3a23a95c661aba501470ed665c127e7590d.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/5/1504854178faf03a74c610f8937273eaa440bc43.png) - type: log paths: - /var/log/bro/current/conn.log - /var/log/bro/current/ssh.log - /var/log/bro/current/rdp.log - /var/log/bro/current/ssl.log - /var/log/bro/current/smb.log - /var/log/bro/current/dpd.log - /var/log/bro/current/dns.log - /var/log/bro/current/http.log fields: logzio\_codec: json token: SqGguNxSjaFgKwnlfCMozZfhueBbAtNX type: zeek fields\_under\_root: true encoding: utf-8 ignore\_older: 3h - type: log paths: - /var/log/bro/current/notice.log fields: logzio\_codec: json token: SqGguNxSjaFgKwnlfCMozZfhueBbAtNX type: zeek\_alert fields\_under\_root: true encoding: utf-8 ignore\_older: 3h filebeat.registry.path: /var/lib/filebeat processors: - rename: fields: - from: "agent" to: "filebeat\_agent" ignore\_missing: true - rename: fields: - from: "log.file.path" to: "source" ignore\_missing: true output.logstash: hosts: ["[app.logz.io:5015](http://app.logz.io:5015)"] ssl: certificate\_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt'] I have generated 4 filebeat.log, I am not sure if they are important. | 2020-02-12T00:01:23.029-0500 | INFO | instance/beat.go:622 | Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat] | | --- | --- | --- | --- | | 2020-02-12T00:01:23.030-0500 | INFO | instance/beat.go:630 | Beat ID: bedf985e-797a-45b9-9161-c79432aaafaf | | 2020-02-11T23:50:07.311-0500 | INFO | instance/beat.go:622 | Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat] | | --- | --- | --- | --- | | 2020-02-11T23:50:07.312-0500 | INFO | instance/beat.go:630 | Beat ID: bedf985e-797a-45b9-9161-c79432aaafaf | | 2020-02-11T23:49:57.869-0500 | INFO | instance/beat.go:622 | Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat] | | --- | --- | --- | --- | | 2020-02-11T23:49:57.869-0500 | INFO | instance/beat.go:630 | Beat ID: bedf985e-797a-45b9-9161-c79432aaafaf | | 2020-02-11T23:48:45.136-0500 | INFO | instance/beat.go:622 | Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat] | | --- | --- | --- | --- | | 2020-02-11T23:48:45.136-0500 | INFO | instance/beat.go:630 | Beat ID: bedf985e-797a-45b9-9161-c79432aaafaf | Thx a lot ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 13, 2020, 3:22am UTC](https://discuss.elastic.co/t/cannot-start-filebeat-7-6/223682/2 "2020-04-13T03:22:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.