# Filebeat cannot send data to logstash

**URL:** <https://discuss.elastic.co/t/filebeat-cannot-send-data-to-logstash/241463>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 16, 2020, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-data-to-logstash/241463 "2020-07-16T13:08:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![binschlag](https://avatars.discourse-cdn.com/v4/letter/b/a4c791/32.png) [@binschlag](https://discuss.elastic.co/u/binschlag)\
**Post date:** [July 16, 2020, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-data-to-logstash/241463/1 "2020-07-16T13:08:38Z")

</div>

My filebeat - agents cannot send data to logstash anymore.

In logstash.log i can see  
**failed to parse field [agent] of type [text] in document with id**

whole message:

`[2020-07-16T15:04:41,302][WARN][logstash.outputs.elasticsearch][main][ee59c3f2b510dd61712dbfff8e1f178035c6d7df420a50210b9ef6339748583e] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2020.07", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x3a143ad5>], :response=>{"index"=>{"_index"=>"logstash-2020.07", "_type"=>"_doc", "_id"=>"S7W6V3MBEXAfkiTnG5lP", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [agent] of type [text] in document with id 'S7W6V3MBEXAfkiTnG5lP'. Preview of field's value: '{hostname=btwebsrv002, name=btwebsrv002, id=11bcdaa9-a452-4e0a-8967-32979b38088c, type=filebeat, ephemeral_id=8153e32b-7c0a-4307-b731-ddc46bbbe586, version=7.8.0}'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:1068"}}}}}`

The whole Elastic Stack is already version 7.8 (Elasticsearch, Kibana, Logstash, Filebeat on each hosts)

Today after restarting a filebeat service on one host, it stopped working and now no one of filebeat agents can send any data to elasticsearch through logstash.

I did a lot of troubleshooting but got stuck. How can i fix this issue?

I want to add, that everything is running on-premise.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [July 21, 2020, 1:25am UTC](https://discuss.elastic.co/t/filebeat-cannot-send-data-to-logstash/241463/2 "2020-07-21T01:25:56Z")

</div>

"agent" is likely a test field in the index, but now is an object with several fields, like agent.version (I think, from memory). This is usually handled by having the agent version in the index name, so when fields change, a new index starts.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2020, 1:25am UTC](https://discuss.elastic.co/t/filebeat-cannot-send-data-to-logstash/241463/3 "2020-08-18T01:25:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.