# Filebeat cannot send output to logstash

**URL:** <https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 28, 2019, 11:07am UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034 "2019-06-28T11:07:53Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_Hafid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dave_hafid/32/48115_2.png) [@Dave\_Hafid](https://discuss.elastic.co/u/Dave_Hafid)\
**Post date:** [June 28, 2019, 11:07am UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/1 "2019-06-28T11:07:53Z")

</div>

Dear ALL,

iam trying to configure filebeat to send output to logstash, after running command filebeat setup i found this error message  
`Exiting: Index management requested but the Elasticsearch output is not configured/enabled`

using filebeat 7.2 and also logstash and elasticsearh  
Filebeat config

```
- type: log
  enabled: true
  paths:
    - "/var/log/apache/*.log"
	
multiline.pattern: ^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}
multiline.negate: true
multiline.match: after

path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
output.logstash:
  hosts: ["192.168.11.10:5044"]

```

if i set to elasticsearch ouput its working need help for this situation  
this is log fileabeat

```
2019-06-28T17:55:32.865+0700	INFO	instance/beat.go:606	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2019-06-28T17:55:32.866+0700	INFO	instance/beat.go:614	Beat ID: 1dd167f0-f0a2-4c40-a324-0abc904c76e4
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:902	Beat info	{"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "1dd167f0-f0a2-4c40-a324-0abc904c76e4"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:911	Build info	{"system_info": {"build": {"commit": "9ba65d864ca37cd32c25b980dbb4020975288fc0", "libbeat": "7.2.0", "time": "2019-06-20T15:05:30.000Z", "version": "7.2.0"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:914	Go runtime info	{"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.12.4"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:918	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2019-06-28T11:04:53+07:00","containerized":false,"name":"masternode.local.com","ip":["127.0.0.1/8","::1/128","192.168.11.10/25","fe80::77b5:55e5:5b8f:a94d/64"],"kernel_version":"3.10.0-957.el7.x86_64","mac":["00:0c:29:6e:4f:a5"],"os":{"family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":6,"patch":1810,"codename":"Core"},"timezone":"WIB","timezone_offset_sec":25200,"id":"359519df05234eee84b855a24d246937"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:947	Process info	{"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"ambient":null}, "cwd": "/etc/filebeat", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 1605, "ppid": 31546, "seccomp": {"mode":"disabled"}, "start_time": "2019-06-28T17:55:32.100+0700"}}}
2019-06-28T17:55:32.867+0700	INFO	instance/beat.go:292	Setup Beat: filebeat; Version: 7.2.0
2019-06-28T17:55:32.868+0700	INFO	[publisher]	pipeline/module.go:97	Beat name: masternode.local.com
2019-06-28T17:55:32.868+0700	ERROR	instance/beat.go:877	Exiting: Index management requested but the Elasticsearch output is not configured/enabled
```

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [June 28, 2019, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/2 "2019-06-28T15:05:09Z")

</div>

I don't see it explicitly enabled in your configuration that you've provided, however it seems Filebeat is trying to setup Index Lifecycle Management rules on your Elasticsearch cluster. Since you're not connecting to Elasticsearch directly, and you're sending to Logstash instead you can probably just add the below to your config to disable this:

`setup.ilm.enabled: false`

---

<div class="post-metadata">

**Author:** ![Dave\_Hafid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dave_hafid/32/48115_2.png) [@Dave\_Hafid](https://discuss.elastic.co/u/Dave_Hafid)\
**Post date:** [June 29, 2019, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/3 "2019-06-29T12:58:47Z")

</div>

Hi Evesy,

already input `setup.ilm.enabed: false` , still facing same issue..  
any idea about this really need help...

i have 2 dedicated node and 1 masternode so i installed filebeat in masternode.

Thanks

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [June 29, 2019, 6:55pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/4 "2019-06-29T18:55:59Z")

</div>

remove all setup.template config and add this:

```auto
setup.template.enabled: false

```

---

<div class="post-metadata">

**Author:** ![Dave\_Hafid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dave_hafid/32/48115_2.png) [@Dave\_Hafid](https://discuss.elastic.co/u/Dave_Hafid)\
**Post date:** [June 30, 2019, 6:47am UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/5 "2019-06-30T06:47:22Z")

</div>

Hi Martin,

still the same not resolve the problem  
`Exiting: Index management requested but the Elasticsearch output is not configured/enabled`

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [July 1, 2019, 8:34am UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/6 "2019-07-01T08:34:44Z")

</div>

Could you share your full config now that you've added those extras?

Perhaps they're not in the right place or something

---

<div class="post-metadata">

**Author:** ![Dave\_Hafid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dave_hafid/32/48115_2.png) [@Dave\_Hafid](https://discuss.elastic.co/u/Dave_Hafid)\
**Post date:** [July 10, 2019, 6:41am UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/7 "2019-07-10T06:41:37Z")

</div>

HI @Evesy its working now reinstall filebeat and manually import template then running filebeat.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [July 10, 2019, 1:25pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/8 "2019-07-10T13:25:04Z")

</div>

Beats can not setup templates when publishing via Logstash. You need to configure the index setup in Logstash. I guess the presence of `setup.template.settings:` triggers the error message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2019, 1:25pm UTC](https://discuss.elastic.co/t/filebeat-cannot-send-output-to-logstash/188034/9 "2019-08-07T13:25:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.