# Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch

**URL:** <https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 18, 2022, 9:57pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651 "2022-02-18T21:57:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adityadgr8](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\
**Post date:** [February 18, 2022, 9:57pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651/1 "2022-02-18T21:57:47Z")

</div>

Hello Everyone

I am unable to start filebeat service, getting below error:

```auto
 filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
   Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
   Active: failed (Result: start-limit) since Fri 2022-02-18 16:46:50 EST; 1s ago
     Docs: https://www.elastic.co/beats/filebeat
  Process: 61386 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=1/FAILURE)
 Main PID: 61386 (code=exited, status=1/FAILURE)

Feb 18 16:46:50 FALINFCDD0006V systemd[1]: Unit filebeat.service entered failed state.
Feb 18 16:46:50 FALINFCDD0006V systemd[1]: filebeat.service failed.
Feb 18 16:46:50 FALINFCDD0006V systemd[1]: filebeat.service holdoff time over, scheduling restart.
Feb 18 16:46:50 FALINFCDD0006V systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Feb 18 16:46:50 FALINFCDD0006V systemd[1]: start request repeated too quickly for filebeat.service
Feb 18 16:46:50 FALINFCDD0006V systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
Feb 18 16:46:50 FALINFCDD0006V systemd[1]: Unit filebeat.service entered failed state.
Feb 18 16:46:50 FALINFCDD0006V systemd[1]: filebeat.service failed.

```

I have setup only Elasticsearch output and disabled logstash.output, here is the filebeat.yml:

```auto
filebeat.inputs:

- type: log
  enabled: True
  paths:
    - /datavg/elk/filebeatinput/*.json

###elasticsearch output #######
output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]
  hosts: ["http://XX.XXX.XXX.XX:9200"]
  username: "XXXX"
  password: "XXXX"
  index: "broncos"
  setup.template.name: "broncos"
  setup.template.pattern: "broncos"

#### logstash host is disabled/commented#####
output.logstash:
  # The Logstash hosts
  #hosts: ["XX.XXX.XXX.XX:5044"]

```

Why I am still getting the above error and unable to run filebeat

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 18, 2022, 11:26pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651/2 "2022-02-18T23:26:55Z")

</div>

Is the line `output.logstash:` commented? You need to comment the line as well.

---

<div class="post-metadata">

**Author:** ![Adityadgr8](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\
**Post date:** [February 19, 2022, 6:26am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651/3 "2022-02-19T06:26:15Z")

</div>

all the logstash.output attribute were commented. But as per your suggestion, I have commented it also. But still showing the same error.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 19, 2022, 3:31pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651/4 "2022-02-19T15:31:55Z")

</div>

Yes, the `output.logstash` needs to be commented, not just the attributes.

Since it is a systemd error, you need to check the system logs, it should bem in `/var/log/messages` for Red Hat/CentOS based systems or `/var/log/syslog` for Debian/Ubuntu based systems.

Look at the time frame when you tried to start if there is any hint of the issue, you could also try to start it again to get new logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2022, 5:32pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/297651/5 "2022-03-19T17:32:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.