# ELK + Filebeat **URL:** \ **Category:** Elasticsearch\ **Created:** [February 25, 2018, 4:52pm UTC](https://discuss.elastic.co/t/elk-filebeat/121397 "2018-02-25T16:52:00Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![adelfattal](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@adelfattal](https://discuss.elastic.co/u/adelfattal)\ **Post date:** [February 25, 2018, 4:52pm UTC](https://discuss.elastic.co/t/elk-filebeat/121397/1 "2018-02-25T16:52:00Z")
Hello, I am a University student and my project is on the ELK Stack and I have followed the implementation on your Website from Elastic Search, Kibana and Logstash. I understood that I have to send from my servers the Logs to Logstash via Filebeat but when I am testing Filebeat to send Logs on the port 5044 the port is activated but it is not reachable. Is there any modification should I do so that the ELK stack works properly? You can see here the pipeline created in /usr/share/logstash: input { beats { port =\> "5044" } } # The filter part of this file is commented out to indicate that it is # optional. # filter { # # } output { stdout { codec =\> rubydebug } } I just created this pipeline to test if Filebeat was working as mentioned in your tutorial. Rhe configuration of the filebeat.yml: #-------------------------- Elasticsearch output ------------------------------ #output.elasticsearch: # Array of hosts to connect to. #hosts: ["localhost:9200"] # Optional protocol and basic auth credentials. #protocol: "https" #username: "elastic" #password: "changeme" #----------------------------- Logstash output -------------------------------- output.logstash: # The Logstash hosts hosts: ["localhost:5044"] # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications #ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" I deactivated the Elastic Search output I activated the Logstash output and I put the path of the log file that is in your tutorial and still I don't get any answer . This is the answer that I am getting: adel@ubuntu:/usr/share/logstash$ sudo bin/logstash -f first-pipeline.conf --config.reload.automatic WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [INFO] 2018-02-25 23:38:06.264 [main] scaffold - Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"} [INFO] 2018-02-25 23:38:06.674 [main] scaffold - Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"} [WARN] 2018-02-25 23:38:09.533 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2018-02-25 23:38:11.096 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.2.2"} [INFO] 2018-02-25 23:38:13.990 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600} [INFO] 2018-02-25 23:38:18.013 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} [INFO] 2018-02-25 23:38:20.856 [[main]-pipeline-manager] beats - Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"} [INFO] 2018-02-25 23:38:21.248 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - Pipeline started succesfully {:pipeline\_id=\>"main", :thread=\>"#\"} [INFO] 2018-02-25 23:38:21.461 [[main]\1, :pipelines=\>["main"]} Thank you ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 27, 2018, 3:32am UTC](https://discuss.elastic.co/t/elk-filebeat/121397/2 "2018-02-27T03:32:28Z")
Please format your code using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21). It will make your post more readable and will help us help you. Alternatively use markdown style like this: ```` ``` CODE ``` ```` ---
**Author:** ![adelfattal](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@adelfattal](https://discuss.elastic.co/u/adelfattal)\ **Post date:** [February 28, 2018, 7:32am UTC](https://discuss.elastic.co/t/elk-filebeat/121397/3 "2018-02-28T07:32:21Z")
You can see here the pipeline created in /usr/share/logstash: ........................................................................................................................................................ input { beats { port =\> "5044" } } The filter part of this file is commented out to indicate that it is optional. filter { } output { stdout { codec =\> rubydebug } } ........................................................................................................................................................ The configuration of the filebeat.yml: ........................................................................................................................................................ #-------------------------- Elasticsearch output ------------------------------ #output.elasticsearch: Array of hosts to connect to. #hosts: ["localhost:9200"] Optional protocol and basic auth credentials. #protocol: "https" #username: "elastic" #password: "changeme" #----------------------------- Logstash output -------------------------------- output.logstash: The Logstash hosts hosts: ["localhost:5044"] Optional SSL. By default is off. List of root certificates for HTTPS server verifications #ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"] Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" ........................................................................................................................................................ I deactivated the Elastic Search output I activated the Logstash output and I put the path of the log file that is in your tutorial and still I don't get any answer . This is the answer that I am getting: ........................................................................................................................................................ adel@ubuntu:/usr/share/logstash$ sudo bin/logstash -f first-pipeline.conf --config.reload.automatic WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [INFO] 2018-02-25 23:38:06.264 [main] scaffold - Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"} [INFO] 2018-02-25 23:38:06.674 [main] scaffold - Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"} [WARN] 2018-02-25 23:38:09.533 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2018-02-25 23:38:11.096 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.2.2"} [INFO] 2018-02-25 23:38:13.990 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600} [INFO] 2018-02-25 23:38:18.013 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} [INFO] 2018-02-25 23:38:20.856 [[main]-pipeline-manager] beats - Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"} [INFO] 2018-02-25 23:38:21.248 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - -Pipeline started succesfully {:pipeline\_id=\>"main", :thread=\>"#\"} [INFO] 2018-02-25 23:38:21.461 [[main]\1, :pipelines=\>["main"]} ........................................................................................................................................................ Thank you ---
**Author:** ![adelfattal](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@adelfattal](https://discuss.elastic.co/u/adelfattal)\ **Post date:** [February 28, 2018, 7:33am UTC](https://discuss.elastic.co/t/elk-filebeat/121397/4 "2018-02-28T07:33:01Z")
I separated all parts with "........". If any other information needed to solve my problem will be sent directly.. Thank you ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 28, 2018, 12:17pm UTC](https://discuss.elastic.co/t/elk-filebeat/121397/5 "2018-02-28T12:17:06Z")
Please format your code, logs or configuration files using `` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable. Or use markdown style like: ```` ``` CODE ``` ```` There's a live preview panel for exactly this reasons. Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text. If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible. Please update your post. ---
**Author:** ![adelfattal](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@adelfattal](https://discuss.elastic.co/u/adelfattal)\ **Post date:** [February 28, 2018, 1:26pm UTC](https://discuss.elastic.co/t/elk-filebeat/121397/6 "2018-02-28T13:26:36Z")
You can see here the pipeline created in /usr/share/logstash: > [@adel](#): > > \ > input { > beats { > port =\> "5044" > } > } > The filter part of this file is commented out to indicate that it is > optional. > filter { > } > output { > stdout { codec =\> rubydebug } > } The configuration of the filebeat.yml: > [@adel](#): > > \ > #-------------------------- Elasticsearch output ------------------------------ > #output.elasticsearch: > Array of hosts to connect to. > #hosts: ["localhost:9200"] > Optional protocol and basic auth credentials. > #protocol: "https" > #username: "elastic" > #password: "changeme" > #----------------------------- Logstash output -------------------------------- > output.logstash: > The Logstash hosts > hosts: ["localhost:5044"] > Optional SSL. By default is off. > List of root certificates for HTTPS server verifications > #ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"] > Certificate for SSL client authentication > #ssl.certificate: "/etc/pki/client/cert.pem" I deactivated the Elastic Search output I activated the Logstash output and I put the path of the log file that is in your tutorial and still I don't get any answer . This is the answer that I am getting: > [@adel](#): > > \ > adel@ubuntu:/usr/share/logstash$ sudo bin/logstash -f first-pipeline.conf --config.reload.automatic > WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults > Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console > [INFO] 2018-02-25 23:38:06.264 [main] scaffold - Initializing module {:module\_name=\>"netflow", :directory=\>"/usr/share/logstash/modules/netflow/configuration"} > [INFO] 2018-02-25 23:38:06.674 [main] scaffold - Initializing module {:module\_name=\>"fb\_apache", :directory=\>"/usr/share/logstash/modules/fb\_apache/configuration"} > [WARN] 2018-02-25 23:38:09.533 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified > [INFO] 2018-02-25 23:38:11.096 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.2.2"} > [INFO] 2018-02-25 23:38:13.990 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600} > [INFO] 2018-02-25 23:38:18.013 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50} > [INFO] 2018-02-25 23:38:20.856 [[main]-pipeline-manager] beats - Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"} > [INFO] 2018-02-25 23:38:21.248 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - -Pipeline started succesfully {:pipeline\_id=\>"main", :thread=\>"#\"} > [INFO] 2018-02-25 23:38:21.461 [[main]\ [INFO] 2018-02-25 23:38:21.481 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - Pipelines running {:count=\>1, :pipelines=\>["main"]} Thank you ---
**Author:** ![adelfattal](https://avatars.discourse-cdn.com/v4/letter/a/bb73d2/32.png) [@adelfattal](https://discuss.elastic.co/u/adelfattal)\ **Post date:** [March 6, 2018, 7:55am UTC](https://discuss.elastic.co/t/elk-filebeat/121397/7 "2018-03-06T07:55:08Z")
Hello, Can anyone tell me where the problem is because this problem isn't letting me advance in my University Project. Thank you ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 8, 2018, 4:37am UTC](https://discuss.elastic.co/t/elk-filebeat/121397/8 "2018-03-08T04:37:56Z")
> [@adelfattal](#): > > the port 5044 the port is activated but it is not reachable What do you mean by this? Can you show filebeat logs? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 5, 2018, 4:37am UTC](https://discuss.elastic.co/t/elk-filebeat/121397/9 "2018-04-05T04:37:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.