# Failed to start filebeat. (debian)

**URL:** <https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 8, 2018, 9:53am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202 "2018-04-08T09:53:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AJ\_NOURI](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aj_nouri/32/29741_2.png) [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\
**Post date:** [April 8, 2018, 9:53am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202/1 "2018-04-08T09:53:56Z")

</div>

I am using ELK as separate containers:

```
$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
3a3b9a484831 logstash "/docker-entrypoin..." 25 minutes ago Up 25 minutes 0.0.0.0:5044->5044/tcp logstash
7a4829ac080d kibana "/docker-entrypoin..." 50 minutes ago Up 38 minutes 0.0.0.0:5601->5601/tcp kibana
6148a8af18e6 elasticsearch "/docker-entrypoin..." About an hour ago Up About an hour 0.0.0.0:9200->9200/tcp, 0.0.0.0:9300->9300/tcp elasticsearch

```

Installed Filebeat on debian host.

```
$ sudo cat /etc/filebeat/filebeat.yml | egrep -v '^ *#|^$' 
filebeat.prospectors:
- type: log
  enabled: false
  paths:
      - /var/log/syslog
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
  host: "localhost:5601"
output.elasticsearch:
  hosts: ["localhost:9200"]
output.logstash:
  hosts: ["localhost:5044"]

```

$ sudo systemctl status filebeat  
● filebeat.service - filebeat  
Loaded: loaded (/lib/systemd/system/filebeat.service; disabled)  
Active: failed (Result: start-limit) since Sun 2018-04-08 11:40:56 CEST; 12min ago  
Docs: [https://www.elastic.co/guide/en/beats/filebeat/current/index.html](https://www.elastic.co/guide/en/beats/filebeat/current/index.html)  
Process: 30511 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)  
Main PID: 30511 (code=exited, status=1/FAILURE)

```
Apr 08 11:40:55 gns3-iouvm systemd[1]: Unit filebeat.service entered failed state.
Apr 08 11:40:56 gns3-iouvm systemd[1]: filebeat.service holdoff time over, scheduling restart.
Apr 08 11:40:56 gns3-iouvm systemd[1]: Stopping filebeat...
Apr 08 11:40:56 gns3-iouvm systemd[1]: Starting filebeat...
Apr 08 11:40:56 gns3-iouvm systemd[1]: filebeat.service start request repeated too quickly, refusing to start.
Apr 08 11:40:56 gns3-iouvm systemd[1]: Failed to start filebeat.
Apr 08 11:40:56 gns3-iouvm systemd[1]: Unit filebeat.service entered failed state.
```

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 9, 2018, 9:54am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202/2 "2018-04-09T09:54:59Z")

</div>

Could you please format your config using `</>`? Also, could you share the debug logs of Filebeat?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 9, 2018, 9:58am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202/3 "2018-04-09T09:58:41Z")

</div>

Looking at your config again the problem seems to be that you want to send logs to both Elasticsearch and Logstash. You can only send to one output using Filebeat. You have to options to work around this problem:

1. Run multiple instances of Filebeat on the same host. Have one Filebeat send to Elasticsearch and one to Logstash.
2. Remove Filebeat from the architecture and use Logstash for routing events.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2018, 9:59am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-debian/127202/4 "2018-05-07T09:59:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.