# Failed to start filebeat (more than one namespace) **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 30, 2018, 11:00am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016 "2018-04-30T11:00:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![bz\_Os](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bz_os/32/90863_2.png) [@bz\_Os](https://discuss.elastic.co/u/bz_Os)\ **Post date:** [April 30, 2018, 11:00am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/1 "2018-04-30T11:00:54Z")
when i start filebeat and see status of service i have as output ; more than one namespace configured accessing 'output' /etc/filebeat/filebeat.yml how can i resolve this problem ,(i am trying to send bro logs to elastic search) ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 30, 2018, 11:27am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/2 "2018-04-30T11:27:33Z")
This could be caused by some settings misplaced in the configuration file, can you share your config? What version of filebeat are you using? ---
**Author:** ![bz\_Os](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bz_os/32/90863_2.png) [@bz\_Os](https://discuss.elastic.co/u/bz_Os)\ **Post date:** [April 30, 2018, 1:52pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/3 "2018-04-30T13:52:29Z")
the version :logstash-input-beats (3.1.30) the configuration #=========================== Filebeat prospectors ============================= filebeat.prospectors: - type: log enabled: true paths: - /nsm/bro/logs/current/conn.log fields: type:"bro-conn" filebeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false output.elasticsearch: hosts: ["localhost:9200"] output.logstash: hosts: ["localhost:5044"] ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 30, 2018, 2:19pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/4 "2018-04-30T14:19:59Z")
I see you have two outputs configured, but Beats supports only one. If you need to store the events in multiple places, you can send them from Beats to Logstash and configure the multiple outputs there. ---
**Author:** ![bz\_Os](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bz_os/32/90863_2.png) [@bz\_Os](https://discuss.elastic.co/u/bz_Os)\ **Post date:** [April 30, 2018, 3:37pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/5 "2018-04-30T15:37:28Z")
thanks jsoriano the probleme is fixed,i had coment output.elsaticsearch and hosts ,but another problem appeared when i attempt to start and see the status i have as output :error in initting prospector:required 'object' ,but fund 'string' in field 'filebear.prospecrots.0.fields '(source:/etc/filebeat/filebeat.yml ---
**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\ **Post date:** [April 30, 2018, 4:42pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/6 "2018-04-30T16:42:01Z")
Can you paste the new config? When pasting it here you can enclose it between three backticks (`````) to keep its format. ---
**Author:** ![bz\_Os](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bz_os/32/90863_2.png) [@bz\_Os](https://discuss.elastic.co/u/bz_Os)\ **Post date:** [April 30, 2018, 5:07pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/7 "2018-04-30T17:07:56Z")
the probleme was fixed by using this configuration :[https://github.com/dunbarcyber/cyphondock/blob/master/config-COPYME/beats/filebeat/filebeat.yml](https://github.com/dunbarcyber/cyphondock/blob/master/config-COPYME/beats/filebeat/filebeat.yml) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 28, 2018, 5:08pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-more-than-one-namespace/130016/8 "2018-05-28T17:08:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.