Filebeat cannot start

Elastic Stack Beats
1

I'm trying to connect filebeat to elasticsearch through logstash but filebeat always fails to start. It works if I connect filebeat directly to elasticsearch.
filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/apache2/error.log

output.elasticsearch enabled

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: "elastic"
  password: "password"

output.logstash enabled

output.logstash:
  enabled: true
  hosts: ["localhost:5044"]
2

You cannot have both ES and LS.

You should have:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/apache2/error.log

output.logstash:
  hosts: ["localhost:5044"]

If something is not working, check logs.

3

Just to clarify, I did not enable both in filebeat.yml, I just wanted to put both in the question. It works when i comment out output.logstash but uncomment output.elasticsearch. When I comment out output.elasticsearch and uncomment output.logstash, filebeat is unable to start.

4

Check filebeat.log, there should be more info. Like LS not reachable or LS cannot reach ES.

5

Inside /var/log/filebeat, there are only filebeat, filebeat.1, ..., filebeat.7 . There is no .log file unless these are the log files?

6

The filebeat file should contain current log records. If you wan to set logging params check here.

However, first make sure that your config is OK:
filebeat test config

You can start FB as a process and will see what's happening:
filebeat -e

For more commands check here.

It's useful to know that FB can read the input correctly, before go directly to ES/LS. Change in filebeat.yml:

output.console:
  pretty: true