# Configure metricbeat to use logstash--tutorial error?

**URL:** <https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143>\
**Category:** Logstash\
**Created:** [February 23, 2021, 2:08am UTC](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143 "2021-02-23T02:08:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_McDonnell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_mcdonnell/32/83901_2.png) [@John\_McDonnell](https://discuss.elastic.co/u/John_McDonnell)\
**Post date:** [February 23, 2021, 2:08am UTC](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143/1 "2021-02-23T02:08:30Z")

</div>

I've set up a 7.11 Kibana-Elastisearch-Logstash-Beats stack more-or-less successfully, but I am unable to configure metricbeat to use logstash. (I am able to see metricbeat data sending it directly to elastisearch.)

Following the tutorial, at [Add user information in Logstash | Elasticsearch Reference [7.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/get-started-logstash-user.html), step 3 on this page says that the link [Getting started with the Elastic Stack | Getting Started [7.11] | Elastic](https://www.elastic.co/guide/en/elastic-stack-get-started/7.11/get-started-elastic-stack.html) showed how to configure metricbeat to use logstash, but it doesn't. The referenced tutorial only explains how to configure metricbeat to use elasticsearch directly. I have been unable to find a tutorial explaining how to get metricbeat to feed logstash, and have been unable to figure out how to do it. I'm guessing it isn't complicated, but that I'm just missing something that will be obvious in retrospect.

I also wanted to report what appears to be an error in the tutorial.

To answer the obvious question, "What's your goal?" the answer is simple--I just want to understand how to do this. Once I get it working, I'll evaluate whether logstash is helping in this use case.

--John Mc

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 23, 2021, 2:20am UTC](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143/2 "2021-02-23T02:20:06Z")

</div>

I do not have a metricbeat install handy, but I would expect it just requires a couple of edits to the [metricbeat.yml](https://github.com/elastic/beats/blob/f4b7a25c09746061e8085784909651f8ecb6bf7b/metricbeat/metricbeat.reference.yml#L1386).

Uncomment some lines so that you have

```
output.logstash:
  # Boolean flag to enable or disable the output module.
  enabled: true

  # The Logstash hosts
  hosts: ["localhost:5044"]

```

and configure logstash with a [beats](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html) input.

---

<div class="post-metadata">

**Author:** ![John\_McDonnell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_mcdonnell/32/83901_2.png) [@John\_McDonnell](https://discuss.elastic.co/u/John_McDonnell)\
**Post date:** [February 27, 2021, 11:34pm UTC](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143/3 "2021-02-27T23:34:45Z")

</div>

That's what I assumed initially and tried it; no errors, but also no data going to Kibana. I'm assuming there are specific metricbeat Logstash ingest/parsing/output files required, but can't find any tutorials on that. I have a Logstash pipeline set up based on the link you provided, and it's working for filebeats.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 27, 2021, 11:59pm UTC](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143/4 "2021-02-27T23:59:39Z")

</div>

Here is the minimum for metricbeat -\> logstash -\> elasticsearch with all defaults on localhost.

Download all elasticsearch and kibana change nothing, start elasticsearch, then kibana.

Download metricbeat change nothing run

`metricbeat setup -e`

Then edit metricbeat.yml and comment out `output.elasticsearch` section and simple uncomment the `output.logstash` so it looks like

```
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

```

Download logstash I would start with the tar.gz first as it is a good way to learn / debug change nothing.

Create this beats-logstash.conf, This is _the_ minimum it will also automatically pass on the right metadata form beats that have pipelines etc.

```
################################################
# beats->logstash->es default config.
################################################
input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "http://localhost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}"
      user => "elastic"
      password => "secret"
    }
  }
}

```

start logstash using the -f

`./bin/logstash -f /path/to/conf/beats-logstash.conf`

Start metricbeat

`metricbeat -e`

Observe data in Kbana and Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2021, 11:59pm UTC](https://discuss.elastic.co/t/configure-metricbeat-to-use-logstash-tutorial-error/265143/5 "2021-03-27T23:59:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.