Failed to start filebeat

im testing to check if my filebeat is running using this script " curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'" and the output was

"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
"hits" : {
"total" : 0,
"max_score" : 0.0,
"hits" : [ ]

can you guys help me this.

thanks a lot in advance

That doesn't tell us much unfortunately.

Have you looked at the logs of things? What versions have you installed? What does your config look like?

version: OpenJDK Runtime Environment (build 1.8.0_161-b14)

- /var/log/secure
- /var/log/messages
# - /var/log/*.log

  input_type: log
  document_type: syslog

registry_file: /var/lib/filebeat/registry

hosts: ["elk_server_private_ip:5044"]
bulk_max_size: 1024

  certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]


rotateeverybytes: 10485760 # = 10MB

status of filebeat:

Process: 7860 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE

my source is :

i followed all the steps given in this tutorial to install all the services but when i test my connection. i cant get the same result as indicated in the tutorial.

(sorry if i cant give you the exact answer that want you to hear. im new for this tech.)

Always post configurations as preformatted text. Use markdown or the </> toolbar button.

You need to locate the Filebeat log and inspect it. Since you appear to have installed Filebeat with the RPM you should find the log file in /var/log/filebeat (see

Also, this is the Logstash category. You have a Filebeat problem, so I suggest you move this question to the Filebeat category.

thank you :slight_smile:

can you pls share the logs of filebeat so that we can identify the exact issue...???

hi @harsh where can i get this log file?

you can check /var/log/filebeat and paste here..??

hi @harshbajaj16 thank you for your help my filebeat is now working.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.