# Filebeat: \`Active: active (exiting) is coming code=exited status=1
**URL:** https://discuss.elastic.co/t/filebeat-active-active-exiting-is-coming-code-exited-status-1/366809
**Category:** Logs
**Tags:** elastic-stack-monitoring
**Created:** [September 19, 2024, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-active-active-exiting-is-coming-code-exited-status-1/366809 "2024-09-19T15:55:19Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@BINDUN26](https://discuss.elastic.co/u/BINDUN26)
#### Post date: [September 19, 2024, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-active-active-exiting-is-coming-code-exited-status-1/366809/1 "2024-09-19T15:55:19Z")
filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/filebeat.service.d
└─startup-timeout.conf
Active: active (exiting) since thu 2024-09-19 14:01:21 IST; 172ms ago
Docs: [Filebeat: Lightweight Log Analysis & Elasticsearch | Elastic](https://www.elastic.co/beats/filebeat)
Main PID: 280411 (filebeat)
Tasks: 1 (limit: 9329)
---
### Author:  [@BINDUN26](https://discuss.elastic.co/u/BINDUN26)
#### Post date: [September 19, 2024, 4:00pm UTC](https://discuss.elastic.co/t/filebeat-active-active-exiting-is-coming-code-exited-status-1/366809/2 "2024-09-19T16:00:18Z")
while testing the configuration, the output is 'config OK' , how can i resolve this issue?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 22, 2024, 7:03pm UTC](https://discuss.elastic.co/t/filebeat-active-active-exiting-is-coming-code-exited-status-1/366809/3 "2024-09-22T19:03:18Z")
You will need to check the filebeat logs and look for the `ERROR`s
What version are you on?
Did you check
`journalctl -u filebeat.service`
---
### Author:  [@BINDUN26](https://discuss.elastic.co/u/BINDUN26)
#### Post date: [September 25, 2024, 6:18am UTC](https://discuss.elastic.co/t/filebeat-active-active-exiting-is-coming-code-exited-status-1/366809/4 "2024-09-25T06:18:57Z")
command: journalctl -u filebeat.service
Sep 16 11:00:56 webminsquid systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
Sep 16 11:00:56 webminsquid filebeat[439893]: Exiting: error initializing publisher: missing required field accessing 'output.logstash.hosts'
Sep 16 11:00:56 webminsquid systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
after trying this also it is coming like this
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [September 25, 2024, 9:28am UTC](https://discuss.elastic.co/t/filebeat-active-active-exiting-is-coming-code-exited-status-1/366809/5 "2024-09-25T09:28:33Z")
> [@BINDUN26](#):
>
> output.logstash.hosts
Go to filebeat.yml and set:
```auto
output.logstash:
hosts: ["localhost:5044"]
```
Might be not set or indent YAML structure is not OK.
Not sure do you need to send data to ES, you cannot have it both active in yml:
```auto
output.elasticsearch:
hosts: ["localhost:9200"]
username: "user"
password: "pass"
#protocol: "https"
```