# Error: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch

**URL:** <https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 24, 2019, 5:50pm UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106 "2019-07-24T17:50:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saber.Tala](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Saber.Tala](https://discuss.elastic.co/u/Saber.Tala)\
**Post date:** [July 24, 2019, 5:50pm UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106/1 "2019-07-24T17:50:10Z")

</div>

Got following error when tried to start Filebeat service:

```
[root@VM1 filebeat]# systemctl start filebeat
Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?
**Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch**

[root@VM1 filebeat]# less /etc/filebeat/filebeat.yml
filebeat:
      paths:
        - /var/log/secure
        - /var/log/messages
        # - /var/log/*.log

      type: log
      enabled: true
      document_typ: syslog

output:
  logstash:
    hosts: ["172.27.95.196:5044"]
    bulk_max_size: 1024

    tls:
      certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

shipper:

logging:
  files:
    rotateeverybytes: 10485760 # = 10MB

```

`[root@VM1 filebeat]# less /etc/filebeat/filebeat.reference.yml`  
#========================== Modules configuration =============================  
filebeat.modules:

```
#-------------------------------- System Module --------------------------------
- module: system
  # Syslog
  syslog:
    enabled: true

```

I have installed Filebeat version 7.2.0 on a Red-Hat 7 box and can reach to the port 5044 of logstash.  
On ELK server, I have installed Logstash (7.1.1), ElasticSearch(7.1.1) and Kibana and they are all listening on default ports.

I found the following error on /var/log/filebeat  
`ERROR instance/beat.go:877 Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?`

---

<div class="post-metadata">

**Author:** ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)\
**Post date:** [July 25, 2019, 3:43pm UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106/2 "2019-07-25T15:43:47Z")

</div>

> [@Saber.Tala](#):
>
> filebeat:

I think this should be filebeat.inputs instead of just filebeat

> **[Log input | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html)**

---

<div class="post-metadata">

**Author:** ![Saber.Tala](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Saber.Tala](https://discuss.elastic.co/u/Saber.Tala)\
**Post date:** [August 3, 2019, 12:10am UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106/3 "2019-08-03T00:10:02Z")

</div>

I have changed it to filebeat.inputs but get the same error

```
filebeat.inputs:
      paths:
        - /var/log/secure
        - /var/log/messages
        # - /var/log/*.log

      type: log
      enabled: true
      document_typ: syslog

```

Error:  
Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch.  
Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?

I'm wondering why I can't see any new log in /var/log/filebeat

---

<div class="post-metadata">

**Author:** ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)\
**Post date:** [August 6, 2019, 3:21pm UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106/4 "2019-08-06T15:21:30Z")

</div>

Sorry to hear the issue is still there @Saber.Tala . Because filebeat is displaying errors that it does not know what files to watch, it leads me to believe that the error is in your filebeat.yml format.

Could you try modifying your filebeat.yml to match the default configuration?  
It also looks like you have a typo **"document\_typ"** instead of **"document\_type"** and also, I believe **document\_type** has been deprecated in Filebeat version 6.x and was used for the old filebeat.prospectors which have been replaced by inputs.  
Please try to remove document\_type, copy the same variables and order/formatting with dashes, so that "type" is at the top, "enabled" is below that, then "paths"

You can use this reference file to help, ctrl+f for "Filebeat inputs" to get to the input section:  
[https://www.elastic.co/guide/en/beats/filebeat/7.2/filebeat-reference-yml.html](https://www.elastic.co/guide/en/beats/filebeat/7.2/filebeat-reference-yml.html)

Similar issue here: [Filebeat file-god stopped and No modules or prospectors enabled and configuration reloading disabled](https://discuss.elastic.co/t/filebeat-file-god-stopped-and-no-modules-or-prospectors-enabled-and-configuration-reloading-disabled/129145/2)

Hope this fixes the issue

---

<div class="post-metadata">

**Author:** ![Saber.Tala](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Saber.Tala](https://discuss.elastic.co/u/Saber.Tala)\
**Post date:** [August 7, 2019, 12:28am UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106/5 "2019-08-07T00:28:03Z")

</div>

Thanks for your help, filebeat is now up and running, but I can't see any index in Kibana, from the machine that I installed fileabeat, I can telnet to Logstash over port 5044, however I can see flowing errors in /var/log/messages:

```
Aug 6 15:49:37 pfmwfdbs01 filebeat: 2019-08-06T15:49:37.041-0700#011INFO#011pipeline/output.go:105#011Connection to backoff(async(tcp://172.27.95.196:5044)) established
Aug 6 15:49:37 pfmwfdbs01 filebeat: 2019-08-06T15:49:37.074-0700#011ERROR#011logstash/async.go:256#011Failed to publish events caused by: lumberjack protocol error
Aug 6 15:49:37 pfmwfdbs01 filebeat: 2019-08-06T15:49:37.076-0700#011ERROR#011logstash/async.go:256#011Failed to publish events caused by: client is not connected

```

Any clue why filebeat doesn't send logs to Kibana/ElastichSearch?

---

<div class="post-metadata">

**Author:** ![justkind](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@justkind](https://discuss.elastic.co/u/justkind)\
**Post date:** [August 7, 2019, 4:28am UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106/6 "2019-08-07T04:28:00Z")

</div>

Great to hear it's up and running now @Saber.Tala! Hmm it might be a good idea to post your full configuration files for both filebeat and logstash but it seems like it might be an issue with the logstash output in your filebeat.yml

I don't have ssl/tls configured for my stack so I don't have any references, but it seems like you are again using very outdated configuration options.

According to the Logstash output plugin, the TLS option was last used in version 1.3:  
[https://www.elastic.co/guide/en/beats/filebeat/1.3/logstash-output.html](https://www.elastic.co/guide/en/beats/filebeat/1.3/logstash-output.html)

Please follow all the documentation for your specific version which is version 7.2 where it is now under SSL:  
[https://www.elastic.co/guide/en/beats/filebeat/7.2/logstash-output.html](https://www.elastic.co/guide/en/beats/filebeat/7.2/logstash-output.html)

More links:  
[Filebeat 7.2 SSL section](https://www.elastic.co/guide/en/beats/filebeat/7.2/logstash-output.html#_literal_ssl_literal_2)  
[Filebeat 7.2 Output SSL settings](https://www.elastic.co/guide/en/beats/filebeat/7.2/configuration-ssl.html)  
[Logstash 7.1 Beats input](https://www.elastic.co/guide/en/logstash/7.1/plugins-inputs-beats.html)

Look over the above links and make sure your filebeat ssl settings and logstash beats input settings are correct

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 4:28am UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106/7 "2019-09-04T04:28:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.