# Elasticsearch not loading logs from logstash and filebeat **URL:** \ **Category:** Elasticsearch\ **Created:** [March 14, 2024, 10:35am UTC](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391 "2024-03-14T10:35:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![codi639](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@codi639](https://discuss.elastic.co/u/codi639)\ **Post date:** [March 14, 2024, 10:35am UTC](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391/1 "2024-03-14T10:35:53Z")
Hello guys, I'm trying to build a SIEM, after searching for different solutions I wanted to try the ELK-Stack with Filebeat. I've followed this [tutorial](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-22-04), and occur the error at the end of the fourth part. I tried to reinstall, but got the exact same error. Since I don't really know how this stack works I'm struggling to debug the problem. I don't have any logs on filebeat, elasticsearch or logstash. Running netstat show me that all of my services are correctly running and I can reach my Kibana web dashboard (which is empty). Why is my logstash not sending data to my elasticsearch? Can filebeat be struggling to send data to logstash? My different configuration files looks the same as in the tutorial. Regards ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [March 14, 2024, 11:11am UTC](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391/2 "2024-03-14T11:11:57Z")
Welcome! I'd not follow a non official outdated guide. This one is 2 years old, using a 7.x version where we are at 8.12.2 😉 And do you know that Elastic has now an out of the box [SIEM experience](https://www.elastic.co/security/siem) available within the [Security solution](https://www.elastic.co/security)? You have an up to date staring guide at [Getting started: Use Elastic Security for SIEM | Starting with the Elasticsearch Platform and its Solutions [8.12] | Elastic](https://www.elastic.co/guide/en/starting-with-the-elasticsearch-platform-and-its-solutions/current/getting-started-siem-security.html) I'd follow it. Please note that step 1 indicates the usage of Elastic Cloud as it's much easier to set it up, but you can always [run that locally](https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html), either with [Docker compose](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#docker-compose-file) or directly. You "just" need to start Elasticsearch and Kibana. There's also a quickstart video at [Free training for threat detection with Elastic Security | Elastic Training](https://www.elastic.co/training/elastic-security-quick-start) ---
**Author:** ![codi639](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@codi639](https://discuss.elastic.co/u/codi639)\ **Post date:** [March 14, 2024, 1:54pm UTC](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391/3 "2024-03-14T13:54:57Z")
Hello, Thanks for your reply, I guess the tutorial is too old and not enough precise for what I want. I didn't know Elastic has a SIEM solution, but my company want to work only with **free** Open Source project... I'm okay with building it by myself with Elastic solutions: [elastic-download](https://www.elastic.co/fr/downloads) For the installation, I ran the commands: ```bash curl https://artifacts.elastic.co/downloads/kibana/kibana-8.12.2-amd64.deb --output kibana-8.12.2-amd64.deb curl https://artifacts.elastic.co/downloads/logstash/logstash-8.12.2-amd64.deb --output logstash-8.12.2-amd64.deb curl https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.12.2-amd64.deb --output elasticsearch-8.12.2-amd64.deb dpkg -i *.deb ``` But I got weird results. ```log root@ELK-Stack:~# tail -f /var/log/elasticsearch/elasticsearch.log [2024-03-14T14:44:44,528][ERROR][o.e.b.Elasticsearch] [ELK-Stack] fatal exception while booting Elasticsearch java.lang.RuntimeException: can not run elasticsearch as root at org.elasticsearch.bootstrap.Elasticsearch.initializeNatives(Elasticsearch.java:282) ~[elasticsearch-8.12.2.jar:?] at org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:167) ~[elasticsearch-8.12.2.jar:?] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:72) ~[elasticsearch-8.12.2.jar:?] ``` I tried a fresh install by following this [topic](https://discuss.elastic.co/t/after-new-install-can-not-run-elasticsearch-as-root/196796/11), but got the same `can not run elasticsearch as root` Should I just change the name of my topic as 'Struggling with ELK installation', or open a new one? Regards ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [March 14, 2024, 3:10pm UTC](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391/4 "2024-03-14T15:10:25Z")
> [@codi639](#): > > `java.lang.RuntimeException: can not run elasticsearch as root` As the message says, you cannot run elasticsearch as root, you need to run it using the `elasticsearch` user. Since you installed it as a `deb` package, you need to run it as a service with `systemd`. Try `systemctl start elasticsearch`, this will start elasticsearch as the `elasticsearch` user. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 11, 2024, 3:10pm UTC](https://discuss.elastic.co/t/elasticsearch-not-loading-logs-from-logstash-and-filebeat/355391/5 "2024-04-11T15:10:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.