Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch - Certificate problem?

[rpaterson (robbie paterson)]

Hey followed this guide to install ELK on a Ubuntu VM. https://www.howtoforge.com/tutorial/ubuntu-elastic-stack/

Can't get filebeat to start. Don't know what I've done wrong. Get this error when running 'sudo service filebeat status'

● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
Active: inactive (dead) (Result: exit-code) since Thu 2018-11-22 07:47:44 PST; 6min ago
Docs: https://www.elastic.co/products/beats/filebeat
Process: 13032 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/file
Main PID: 13032 (code=exited, status=1/FAILURE)

Nov 22 07:47:44 ubuntu systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Nov 22 07:47:44 ubuntu systemd[1]: filebeat.service: Unit entered failed state.
Nov 22 07:47:44 ubuntu systemd[1]: filebeat.service: Failed with result 'exit-code'.
Nov 22 07:47:44 ubuntu systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
Nov 22 07:47:44 ubuntu systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Nov 22 07:47:44 ubuntu systemd[1]: filebeat.service: Start request repeated too quickly.
Nov 22 07:47:44 ubuntu systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..

https://pastebin.com/pbBV85WX - Pastebin of Filebeat.yml
https://pastebin.com/NUere47q - Pastebin of Logstash.yml

Sorry if I'm missing anything first time posting here and I'm a complete noob to all of this. But I'm thinking it might be a certificate problem with SSL? I have no idea, been looking through some of the other posts similar to this here but couldn't find anything clear.

[pierhugues (Pier-Hugues Pellerin)]

Hello @rpaterson,

I saw a few things in the config, I see a few deprecated options used in the filebeat.yml.
I also see that you have 2 outputs enabled at the same time, Filebeat only support 1 output.

The following error message also mention the two outputs.

Nov 22 07:47:44 ubuntu systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..

Can you remove the output.elasticsearch: from your configuration and try again?

Also, if that doesn't work I suggest to start from fresh and use our getting started guide the options are up to date.