# Data doesn't transfer

**URL:** <https://discuss.elastic.co/t/data-doesnt-transfer/357972>\
**Category:** Logstash\
**Created:** [April 23, 2024, 5:37am UTC](https://discuss.elastic.co/t/data-doesnt-transfer/357972 "2024-04-23T05:37:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![m\_pahlevanzadeh](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\
**Post date:** [April 23, 2024, 5:37am UTC](https://discuss.elastic.co/t/data-doesnt-transfer/357972/1 "2024-04-23T05:37:27Z")

</div>

I have two machine: 1. Fortigate appliance and 2. ELK machine  
In my ELK I have the following services :  
filebeat with the following input and output:

```auto
filebeat.input:
   -type: udp
   host: "172.16.57.222:5044" ## this is FG machine
   max-message-size: 10KiB
   enabled: true
output.logstash:
   host: ["http://localhost:5044"] #TCP 

```

In logstash machine I have:

```auto
input{
        beats {
                     port => 5044
         }
}
output {
  if [@metadata][pipeline] {
	elasticsearch {
  	hosts => ["localhost:9200"]
	user => "elastic"
	password => "changeme"
  	manage_template => false
  	index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  	pipeline => "%{[@metadata][pipeline]}"
	}
  } else {
	elasticsearch {
  	hosts => ["http://localhost:9200"]
	user => "elastic"
	password => "changeme"
  	manage_template => false
  	index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
	}
  }
}

```

Elasticsearchg configuration

```auto
network.host: localhost
http.port: 9200

```

Notes: 1. I can see logs via tcpdump and logs arrived. 2. when I use `filestream` instead of `udp` in `filebeat` I can see logs of system. 3. fortinet is enabled and it's okey.  
But I can't send data from filebeat to kibana such as :

```auto
filebeat->logstash->elastic->kibana

```

---

<div class="post-metadata">

**Author:** ![m\_pahlevanzadeh](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@m\_pahlevanzadeh](https://discuss.elastic.co/u/m_pahlevanzadeh)\
**Post date:** [April 23, 2024, 7:18am UTC](https://discuss.elastic.co/t/data-doesnt-transfer/357972/2 "2024-04-23T07:18:24Z")

</div>

For your case,  
you have to set host: in filebeat to ip address of your ELK:5044  
and in module file you have to set 0.0.0.0