# Failed to start filebeat
**URL:** https://discuss.elastic.co/t/failed-to-start-filebeat/127891
**Category:** Beats
**Tags:** filebeat
**Created:** [April 13, 2018, 2:52am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891 "2018-04-13T02:52:35Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@kuruzuke](https://discuss.elastic.co/u/kuruzuke)
#### Post date: [April 13, 2018, 2:52am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/1 "2018-04-13T02:52:35Z")
im testing to check if my filebeat is running using this script " curl -XGET '[http://localhost:9200/filebeat-\*/\_search?pretty](http://localhost:9200/filebeat-*/_search?pretty)'" and the output was
{
"took" : 1,
"timed\_out" : false,
"\_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max\_score" : 0.0,
"hits" : []
}
}
can you guys help me this.
thanks a lot in advance
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 13, 2018, 3:18am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/2 "2018-04-13T03:18:43Z")
That doesn't tell us much unfortunately.
Have you looked at the logs of things? What versions have you installed? What does your config look like?
---
### Author:  [@kuruzuke](https://discuss.elastic.co/u/kuruzuke)
#### Post date: [April 13, 2018, 3:41am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/3 "2018-04-13T03:41:06Z")
version: OpenJDK Runtime Environment (build 1.8.0\_161-b14)
configuration:
filebeat:
prospectors:
-
paths:
- /var/log/secure
- /var/log/messages
# - /var/log/\*.log
```
input_type: log
document_type: syslog
```
registry\_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["elk\_server\_private\_ip:5044"]
bulk\_max\_size: 1024
```
tls:
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
```
shipper:
logging:
files:
rotateeverybytes: 10485760 # = 10MB
status of filebeat:
Process: 7860 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE
my source is : [https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7#install-elasticsearch](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7#install-elasticsearch)
i followed all the steps given in this tutorial to install all the services but when i test my connection. i cant get the same result as indicated in the tutorial.
(sorry if i cant give you the exact answer that want you to hear. im new for this tech.)
thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 13, 2018, 4:28am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/4 "2018-04-13T04:28:21Z")
Always post configurations as preformatted text. Use markdown or the `` toolbar button.
You need to locate the Filebeat log and inspect it. Since you appear to have installed Filebeat with the RPM you should find the log file in /var/log/filebeat (see [https://www.elastic.co/guide/en/beats/filebeat/current/directory-layout.html](https://www.elastic.co/guide/en/beats/filebeat/current/directory-layout.html)).
Also, this is the Logstash category. You have a Filebeat problem, so I suggest you move this question to the Filebeat category.
---
### Author:  [@kuruzuke](https://discuss.elastic.co/u/kuruzuke)
#### Post date: [April 13, 2018, 5:27am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/5 "2018-04-13T05:27:31Z")
thank you 🙂
---
### Author:  [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)
#### Post date: [April 13, 2018, 5:57am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/6 "2018-04-13T05:57:49Z")
can you pls share the logs of filebeat so that we can identify the exact issue...???
---
### Author:  [@kuruzuke](https://discuss.elastic.co/u/kuruzuke)
#### Post date: [April 13, 2018, 8:39am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/7 "2018-04-13T08:39:36Z")
hi @harsh where can i get this log file?
---
### Author:  [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)
#### Post date: [April 13, 2018, 8:51am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/8 "2018-04-13T08:51:41Z")
you can check /var/log/filebeat and paste here..??
---
### Author:  [@kuruzuke](https://discuss.elastic.co/u/kuruzuke)
#### Post date: [April 13, 2018, 9:08am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/9 "2018-04-13T09:08:00Z")
hi @harshbajaj16 thank you for your help my filebeat is now working.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 11, 2018, 9:08am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat/127891/10 "2018-05-11T09:08:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.