# Filebeat exec **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 8, 2017, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850 "2017-03-08T16:32:26Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/1 "2017-03-08T16:32:26Z")
Is there a way to run an exec on a file and then ship that output to logstash? ---
**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\ **Post date:** [March 8, 2017, 4:39pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/2 "2017-03-08T16:39:07Z")
I think you might be looking for [execbeat](https://github.com/christiangalsterer/execbeat). ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/3 "2017-03-08T16:57:01Z")
gave this a shot but it seems its not working correctly. Nothing is showing up in Elasticsearch. ---
**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\ **Post date:** [March 8, 2017, 4:58pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/4 "2017-03-08T16:58:02Z")
Post your configuration files for Logstash and execbeat and Ill take a look ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 4:58pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/5 "2017-03-08T16:58:12Z")
did a sample run with date. Maybe i am not grabbing the proper index? I assume it is the same as the others execbeat-\*? ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 5:04pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/7 "2017-03-08T17:04:26Z")
[http://www.chopapp.com/#mbwdo1ey](http://www.chopapp.com/#mbwdo1ey) ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/8 "2017-03-08T17:07:26Z")
im just sedning it to ES first. To see if i would even need to get logstash involved ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 5:10pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/9 "2017-03-08T17:10:26Z")
logs in debug mode : 2017-03-08T17:08:39Z INFO execbeat is running! Hit CTRL-C to stop it. 2017-03-08T17:08:39Z DBG Creating poller # 0 with command: date 2017-03-08T17:08:39Z INFO Metrics logging every 30s 2017-03-08T17:09:09Z INFO No non-zero metrics in the last 30s ---
**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\ **Post date:** [March 8, 2017, 5:15pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/10 "2017-03-08T17:15:54Z")
Do you actually have "hosts: ["hostname:9200"]" or are you just masking your ES hostname with the word "hostname"? If the latter, replace "hostname" with the actual hostname of your ES instance ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 5:21pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/11 "2017-03-08T17:21:20Z")
i have the actual hostname in there, jsut replaced it for commenting reasons ---
**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\ **Post date:** [March 8, 2017, 5:22pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/12 "2017-03-08T17:22:57Z")
Anything in your ES logs? ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 5:25pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/13 "2017-03-08T17:25:30Z")
nope all clean ---
**Author:** ![Conall\_Prendergast](https://avatars.discourse-cdn.com/v4/letter/c/d26b3c/32.png) [@Conall\_Prendergast](https://discuss.elastic.co/u/Conall_Prendergast)\ **Post date:** [March 8, 2017, 5:26pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/14 "2017-03-08T17:26:30Z")
Is ES listening on a local interface by any chance? (localhost) Is execbeat and ES running on the same machine? ---
**Author:** ![kmroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmroz/32/62741_2.png) [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Post date:** [March 8, 2017, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/15 "2017-03-08T17:28:17Z")
it is not, i have other stuff reporting to this ES instace no problem (metricbeat) . execbeat is running on a different host ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 5, 2017, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-exec/77850/16 "2017-04-05T17:28:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.