# Filebeat cannot start

**URL:** <https://discuss.elastic.co/t/filebeat-cannot-start/369992>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 4, 2024, 9:01am UTC](https://discuss.elastic.co/t/filebeat-cannot-start/369992 "2024-11-04T09:01:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Xavier\_24314](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavier_24314/32/138933_2.png) [@Xavier\_24314](https://discuss.elastic.co/u/Xavier_24314)\
**Post date:** [November 4, 2024, 9:01am UTC](https://discuss.elastic.co/t/filebeat-cannot-start/369992/1 "2024-11-04T09:01:55Z")

</div>

I'm trying to connect filebeat to elasticsearch through logstash but filebeat always fails to start. It works if I connect filebeat directly to elasticsearch.  
filebeat.yml

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/apache2/error.log

```

output.elasticsearch enabled

```auto
output.elasticsearch:
  hosts: ["localhost:9200"]
  username: "elastic"
  password: "password"

```

output.logstash enabled

```auto
output.logstash:
  enabled: true
  hosts: ["localhost:5044"]

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 4, 2024, 11:04am UTC](https://discuss.elastic.co/t/filebeat-cannot-start/369992/2 "2024-11-04T11:04:54Z")

</div>

You cannot have both ES and LS.

You should have:

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/apache2/error.log

output.logstash:
  hosts: ["localhost:5044"]

```

If something is not working, check logs.

---

<div class="post-metadata">

**Author:** ![Xavier\_24314](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavier_24314/32/138933_2.png) [@Xavier\_24314](https://discuss.elastic.co/u/Xavier_24314)\
**Post date:** [November 4, 2024, 11:13am UTC](https://discuss.elastic.co/t/filebeat-cannot-start/369992/3 "2024-11-04T11:13:24Z")

</div>

Just to clarify, I did not enable both in filebeat.yml, I just wanted to put both in the question. It works when i comment out output.logstash but uncomment output.elasticsearch. When I comment out output.elasticsearch and uncomment output.logstash, filebeat is unable to start.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 4, 2024, 2:27pm UTC](https://discuss.elastic.co/t/filebeat-cannot-start/369992/4 "2024-11-04T14:27:56Z")

</div>

Check filebeat.log, there should be more info. Like LS not reachable or LS cannot reach ES.

---

<div class="post-metadata">

**Author:** ![Xavier\_24314](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavier_24314/32/138933_2.png) [@Xavier\_24314](https://discuss.elastic.co/u/Xavier_24314)\
**Post date:** [November 5, 2024, 2:33am UTC](https://discuss.elastic.co/t/filebeat-cannot-start/369992/5 "2024-11-05T02:33:09Z")

</div>

Inside /var/log/filebeat, there are only filebeat, filebeat.1, ..., filebeat.7 . There is no .log file unless these are the log files?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 5, 2024, 5:40am UTC](https://discuss.elastic.co/t/filebeat-cannot-start/369992/6 "2024-11-05T05:40:07Z")

</div>

The _filebeat_ file should contain current log records. If you wan to set logging params check [here](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html).

However, first make sure that your config is OK:  
`filebeat test config`

You can start FB as a process and will see what's happening:  
`filebeat -e`

For more commands check [here](https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html).

It's useful to know that FB can read the input correctly, before go directly to ES/LS. Change in filebeat.yml:

```auto
output.console:
  pretty: true

```