# Filebeat does not send data to logstash

**URL:** <https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 3, 2018, 8:08pm UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338 "2018-06-03T20:08:15Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kavita\_Sidar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavita_sidar/32/31830_2.png) [@Kavita\_Sidar](https://discuss.elastic.co/u/Kavita_Sidar)\
**Post date:** [June 3, 2018, 8:08pm UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/1 "2018-06-03T20:08:15Z")

</div>

I am new to filebeat and logstash and was trying to send log data from filebeat to logstash as per the documentation. But logstash does not disply any output.  
This is the filebeat.yml file:

```
    filebeat.prospectors:
    - type: log
      paths:
        - C:\Users\Sidar\Downloads\Compressed\logstash-tutorial.log
    output.logstash:
         hosts: ["127.0.0.1:5044"]

```

and this is the logstash config file

```
input {
    beats {
        port => "5044"
    }
}
# The filter part of this file is commented out to indicate that it is
# optional.
# filter {
#
# }
output {
    stdout { codec => rubydebug }
}

```

This should display the logs on console but there is not output after

[2018-06-04T01:27:21,147][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50}  
[2018-06-04T01:27:21,677][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"}  
[2018-06-04T01:27:21,782][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x5e86e3df run\>"}  
[2018-06-04T01:27:21,858][INFO][org.logstash.beats.Server] Starting server on port: 5044  
[2018-06-04T01:27:21,954][INFO][logstash.agent] Pipelines running {:count=\>1, :pipelines=\>["main"]}

Please help as I'm not able to diagnose this.

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [June 4, 2018, 3:16am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/2 "2018-06-04T03:16:52Z")

</div>

Hi @Kavita_Sidar,

i've checked you config files it seems ok and your logstash logs are showing that its working fine and ready to collect the logs from filebeat.

but for more understanding the issue i need your filebeat logs so that i can provide the solution to you.

Request you to paste the filebeat logs.

> Path: /etc/filebeat/filebeat

Regards,

---

<div class="post-metadata">

**Author:** ![Kavita\_Sidar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavita_sidar/32/31830_2.png) [@Kavita\_Sidar](https://discuss.elastic.co/u/Kavita_Sidar)\
**Post date:** [June 4, 2018, 5:26am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/3 "2018-06-04T05:26:18Z")

</div>

Here is the filebeat log. Thank you.  
2018-06-01T17:06:37.488-0700 INFO instance/beat.go:468 Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs]  
2018-06-01T17:06:37.503-0700 INFO instance/beat.go:475 Beat UUID: 4cb6864c-ceef-459d-a24d-13e037c99d5b  
2018-06-01T17:06:37.503-0700 INFO instance/beat.go:213 Setup Beat: filebeat; Version: 6.2.4  
2018-06-01T17:06:37.504-0700 INFO pipeline/module.go:76 Beat name: DESKTOP-F4FFD42  
2018-06-01T17:06:37.507-0700 INFO instance/beat.go:301 filebeat start running.  
2018-06-01T17:06:37.507-0700 INFO [monitoring] log/log.go:97 Starting metrics logging every 30s  
2018-06-01T17:06:37.507-0700 INFO registrar/registrar.go:110 Loading registrar data from C:\Program Files\Filebeat\data\registry  
2018-06-01T17:06:37.507-0700 INFO registrar/registrar.go:121 States Loaded from registrar: 0  
2018-06-01T17:06:37.507-0700 WARN beater/filebeat.go:261 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.  
2018-06-01T17:06:37.507-0700 INFO crawler/crawler.go:48 Loading Prospectors: 1  
2018-06-01T17:06:37.508-0700 INFO log/prospector.go:111 Configured paths: [C:\Program Files\Filebeat\logstash-tutorial.log]  
2018-06-01T17:06:37.508-0700 INFO crawler/crawler.go:82 Loading and starting Prospectors completed. Enabled prospectors: 1  
2018-06-01T17:07:07.640-0700 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":46,"time":46}},"info":{"ephemeral\_id":"b399c579-03de-4604-84f7-46a1bc0ad41c","uptime":{"ms":30073}},"memstats":{"gc\_next":4473924,"memory\_alloc":2854736,"memory\_total":2854736,"rss":16138240}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"logstash"},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"cpu":{"cores":4}}}}}  
2018-06-01T17:07:37.509-0700 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":46,"time":46}},"info":{"ephemeral\_id":"b399c579-03de-4604-84f7-46a1bc0ad41c","uptime":{"ms":60074}},"memstats":{"gc\_next":4473924,"memory\_alloc":2906016,"memory\_total":2906016,"rss":2428928}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}  
2018-06-01T17:08:07.509-0700 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":46,"time":46}},"info":{"ephemeral\_id":"b399c579-03de-4604-84f7-46a1bc0ad41c","uptime":{"ms":90074}},"memstats":{"gc\_next":4473924,"memory\_alloc":2946368,"memory\_total":2946368,"rss":-12288}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}  
2018-06-01T17:08:37.509-0700 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":46,"time":46}},"info":{"ephemeral\_id":"b399c579-03de-4604-84f7-46a1bc0ad41c","uptime":{"ms":120075}},"memstats":{"gc\_next":4473924,"memory\_alloc":2984352,"memory\_total":2984352,"rss":-12288}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}  
2018-06-01T17:09:07.509-0700 INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":77,"time":77,"value":77},"user":{"ticks":46,"time":46}},"info":{"ephemeral\_id":"b399c579-03de-4604-84f7-46a1bc0ad41c","uptime":{"ms":150075}},"memstats":{"gc\_next":4473924,"memory\_alloc":3025136,"memory\_total":3025136,"rss":40960}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}  
2018-06-01T17:09:28.109-0700 INFO beater/filebeat.go:323 Stopping filebeat  
2018-06-01T17:09:28.109-0700 INFO crawler/crawler.go:109 Stopping Crawler  
2018-06-01T17:09:28.109-0700 INFO crawler/crawler.go:119 Stopping 1 prospectors  
2018-06-01T17:09:28.109-0700 INFO prospector/prospector.go:121 Prospector ticker stopped  
2018-06-01T17:09:28.109-0700 INFO prospector/prospector.go:138 Stopping Prospector: 9758062311585772904  
2018-06-01T17:09:28.109-0700 INFO crawler/crawler.go:135 Crawler stopped  
2018-06-01T17:09:28.109-0700 INFO registrar/registrar.go:239 Stopping Registrar  
2018-06-01T17:09:28.109-0700 INFO registrar/registrar.go:167 Ending Registrar  
2018-06-01T17:09:28.167-0700 INFO instance/beat.go:308 filebeat stopped.  
2018-06-01T17:09:28.169-0700 INFO [monitoring] log/log.go:132 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":31},"total":{"ticks":93,"time":93,"value":93},"user":{"ticks":62,"time":62}},"info":{"ephemeral\_id":"b399c579-03de-4604-84f7-46a1bc0ad41c","uptime":{"ms":170734}},"memstats":{"gc\_next":4473924,"memory\_alloc":3078504,"memory\_total":3078504,"rss":18706432}},"filebeat":{"harvester":{"open\_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"logstash"},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0},"writes":1},"system":{"cpu":{"cores":4}}}}}  
2018-06-01T17:09:28.170-0700 INFO [monitoring] log/log.go:133 Uptime: 2m50.737057s  
2018-06-01T17:09:28.170-0700 INFO [monitoring] log/log.go:110 Stopping metrics logging.

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [June 4, 2018, 6:11am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/4 "2018-06-04T06:11:45Z")

</div>

it seems ok no error found. Are you able to telnet or ping from filebeat node?

Please check 5044 port is open or not.

Regards,

---

<div class="post-metadata">

**Author:** ![Kavita\_Sidar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavita_sidar/32/31830_2.png) [@Kavita\_Sidar](https://discuss.elastic.co/u/Kavita_Sidar)\
**Post date:** [June 4, 2018, 6:22am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/5 "2018-06-04T06:22:36Z")

</div>

Yes it is able to telnet and ping. The port is open.

---

<div class="post-metadata">

**Author:** ![Kavita\_Sidar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavita_sidar/32/31830_2.png) [@Kavita\_Sidar](https://discuss.elastic.co/u/Kavita_Sidar)\
**Post date:** [June 4, 2018, 7:13am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/7 "2018-06-04T07:13:12Z")

</div>

It worked when i specified the address directly to the log file:  
-`C:\Users\Sidar\Downloads\Compressed\logstash-tutorial.log\logstash-tutorial-dataset`  
in the filebeat.yml file. It's showing output in logstash.

But i dont understand why it was not able to pick file when only the folder was specified.

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [June 4, 2018, 7:41am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/8 "2018-06-04T07:41:52Z")

</div>

Hi,

Sorry but i think there is something wrong in your path you have specified is **.log/logstash-tutorial-dataset** means after log file you mentioned directory or what is this i'm not able to understand.

please explain below configuration a bit more.

> [@](#):
>
> logstash-tutorial.log\logstash-tutorial-dataset

---

<div class="post-metadata">

**Author:** ![Kavita\_Sidar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavita_sidar/32/31830_2.png) [@Kavita\_Sidar](https://discuss.elastic.co/u/Kavita_Sidar)\
**Post date:** [June 4, 2018, 8:59am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/9 "2018-06-04T08:59:43Z")

</div>

Hi,  
logstash-tutorial-dataset is the apache log file and logstash-tutorial.log is the folder which contains logstash-tutorial-dataset file.

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [June 4, 2018, 9:16am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/10 "2018-06-04T09:16:52Z")

</div>

Hi,

Ohk i understood your point now. Please use below format for same and restart the services and try it

> [@](#):
>
> - C:\Users\Sidar\Downloads\Compressed\logstash-tutorial.log\*

Please do let me know if you are still facing issue.

Regards,

---

<div class="post-metadata">

**Author:** ![Kavita\_Sidar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavita_sidar/32/31830_2.png) [@Kavita\_Sidar](https://discuss.elastic.co/u/Kavita_Sidar)\
**Post date:** [June 4, 2018, 10:19am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/11 "2018-06-04T10:19:15Z")

</div>

It worked.😃  
Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2018, 10:19am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-data-to-logstash/134338/12 "2018-07-02T10:19:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.