# Filebeat data stream not updated

**URL:** <https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 7, 2024, 9:57am UTC](https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932 "2024-03-07T09:57:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![star2](https://avatars.discourse-cdn.com/v4/letter/s/71e660/32.png) [@star2](https://discuss.elastic.co/u/star2)\
**Post date:** [March 7, 2024, 9:57am UTC](https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932/1 "2024-03-07T09:57:35Z")

</div>

I use filebeat to collect Suricata's JSON files，But the data stream display of FileBeat never updates,The logs I saw did not show any errors either

 ![微信截图_20240307175504](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5513df8fa49aab7a3964e8e8e891ccfcd973f17.jpeg)

```auto
filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
     Active: active (running) since Thu 2024-03-07 17:50:33 CST; 28s ago
       Docs: https://www.elastic.co/beats/filebeat
   Main PID: 3516 (filebeat)
      Tasks: 8 (limit: 4555)
     Memory: 49.2M
        CPU: 2.623s
     CGroup: /system.slice/filebeat.service
             └─3516 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs >

3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.542+0800","log.logger":"beat","log.origin":{"file.name":"instance/beat.go","file.line":1114},"messag>
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.543+0800","log.logger":"beat","log.origin":{"file.name":"instance/beat.go","file.line":1143},"messag>
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.543+0800","log.origin":{"file.name":"instance/beat.go","file.line":297},"message":"Setup Beat: fileb>
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.546+0800","log.logger":"esclientleg","log.origin":{"file.name":"eslegclient/connection.go","file.lin>
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.546+0800","log.logger":"publisher","log.origin":{"file.name":"pipeline/module.go","file.line":113},">
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.547+0800","log.logger":"modules","log.origin":{"file.name":"fileset/modules.go","file.line":120},"me>
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.547+0800","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":145},"message>
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.548+0800","log.logger":"kibana","log.origin":{"file.name":"kibana/client.go","file.line":179},"messa>
3月 07 17:50:36 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:36.615+0800","log.logger":"add_cloud_metadata","log.origin":{"file.name":"add_cloud_metadata/add_cloud_>
3月 07 17:50:38 star-virtual-machine filebeat[3516]: {"log.level":"info","@timestamp":"2024-03-07T17:50:38.616+0800","log.logger":"kibana","log.origin":{"file.name":"kibana/client.go","file.line":179},"messa>
~

```

---

<div class="post-metadata">

**Author:** ![star2](https://avatars.discourse-cdn.com/v4/letter/s/71e660/32.png) [@star2](https://discuss.elastic.co/u/star2)\
**Post date:** [March 7, 2024, 9:59am UTC](https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932/2 "2024-03-07T09:59:40Z")

</div>

This is my module configuration file

 ![微信截图_20240307175822](https://us1.discourse-cdn.com/elastic/original/3X/7/6/762755df27c173aa0fdfbea60527b1145d22b175.jpeg)

---

<div class="post-metadata">

**Author:** ![larryed](https://avatars.discourse-cdn.com/v4/letter/l/a9adbd/32.png) [@larryed](https://discuss.elastic.co/u/larryed)\
**Post date:** [March 9, 2024, 4:42am UTC](https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932/3 "2024-03-09T04:42:18Z")

</div>

I think it is the filebeat never able to connect to Elasticsearch. Can you show us the configuration of /etc/filebeat/filebeat.yaml? and can you test with command "filebeat test config" and "filebeat test output"

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2024, 6:42am UTC](https://discuss.elastic.co/t/filebeat-data-stream-not-updated/354932/4 "2024-04-06T06:42:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.