# Could not load data from filebeat into logstash

**URL:** <https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 7, 2018, 11:26am UTC](https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966 "2018-06-07T11:26:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![umang\_bhargava](https://avatars.discourse-cdn.com/v4/letter/u/a183cd/32.png) [@umang\_bhargava](https://discuss.elastic.co/u/umang_bhargava)\
**Post date:** [June 7, 2018, 11:26am UTC](https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966/1 "2018-06-07T11:26:25Z")

</div>

Greetings everyone!  
I want to feed my log file from fealbeat into logstash. But i am not able to do it. I am receiving these errors.

```
[2018-06-05T11:30:44,112][INFO][logstash.agent] Pipelines running {:count=>1, :pipelines=>["main"]}
[2018-06-05T11:32:05,045][INFO][org.logstash.beats.BeatsHandler] [local: 0:0:0:0:0:0:0:1:5044, remote: 0:0:0:0:0:0:0:1:31903] Handling exception: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 69
org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84

```

My filebeat.yml file:

> <https://gist.github.com/harshityadav95/6f15b7644f0151752b513fd28362f2b9>

My config file:

```
# The # character at the beginning of a line indicates a comment. Use
# comments to describe your configuration.
input {
beats {
        port => "5044"
    }
}
output {
elasticsearch {
        hosts => ["localhost:9200"]
	}
}

```

My log data(logstash-tutorial-dataset):

83.149.9.216 - - [04/Jan/2015:05:13:42 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-search.png HTTP/1.1" 200 203023 "[http://semicomplete.com/presentations/logstash-monitorama-2013/](http://semicomplete.com/presentations/logstash-monitorama-2013/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_9\_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"  
83.149.9.216 - - [04/Jan/2015:05:13:42 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-dashboard3.png HTTP/1.1" 200 171717 "[http://semicomplete.com/presentations/logstash-monitorama-2013/](http://semicomplete.com/presentations/logstash-monitorama-2013/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_9\_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"

I could not figure out where did i go wrong. I have tried everything . Data is going from logstash(stdin) to elasticsearch but not from filebeat-\>logstash-\>elasticsearch. I am a noob.

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [June 7, 2018, 11:32am UTC](https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966/2 "2018-06-07T11:32:09Z")

</div>

Hi,

I've checked your config file and found that you didn't enable prospector parameter. this is the reason your log files are not harvesting.

**Your config:**

> ```
> # Change to true to enable this prospector configuration.
> enabled: false
> 
> ```

Please set this true like below and restart filebeat service:

> ```
> # Change to true to enable this prospector configuration.
> enabled: true
> 
> ```

Regards,

---

<div class="post-metadata">

**Author:** ![umang\_bhargava](https://avatars.discourse-cdn.com/v4/letter/u/a183cd/32.png) [@umang\_bhargava](https://discuss.elastic.co/u/umang_bhargava)\
**Post date:** [June 7, 2018, 12:35pm UTC](https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966/3 "2018-06-07T12:35:57Z")

</div>

Hey, I had also tried by changing it to true but it was not working beforehand so i toggled it back to false .  
The main reason was there were no spaces between '[' and ' " ' , I added the spaces like  
`host : ["localhost:5044"]`  
and it started working.

And yes, Prosecutor enabled must be true.  
Thank you so much anyway.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2018, 12:36pm UTC](https://discuss.elastic.co/t/could-not-load-data-from-filebeat-into-logstash/134966/4 "2018-07-05T12:36:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.