# Filebeat : Exiting: No outputs are defined. Please define one under the output section

**URL:** <https://discuss.elastic.co/t/filebeat-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/269478>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 7, 2021, 1:58pm UTC](https://discuss.elastic.co/t/filebeat-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/269478 "2021-04-07T13:58:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sourabhjain104](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\
**Post date:** [April 7, 2021, 1:58pm UTC](https://discuss.elastic.co/t/filebeat-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/269478/1 "2021-04-07T13:58:09Z")

</div>

Hello All,  
I am trying to send logs data from my local drive to logstash using filebeat 7.11.0.  
I was able to do it successfully and also create index pattern in kibana.  
I wanted to do some modification so I deleted my index pattern and try to send data again into elasticsearch using Filebeat ==\>Logstash==\>Elasticsearch but its not working.  
I gone through many articles but not able to solve my issue. (I deleted entire filebeat and created again and also deleted registery folder)  
My filebeat.yml is:-

```
    ### Filebeat Configuration Example###

```

# This file is an example configuration file highlighting only the most common

# options. The filebeat.reference.yml file from the same directory contains all the

# supported options with more comments. You can use it as a reference.

# 

# You can find the full configuration reference here:

# [Filebeat Reference | Elastic](https://www.elastic.co/guide/en/beats/filebeat/index.html)

# For more available modules and options, please see the filebeat.reference.yml sample

# configuration file.

# ============= Filebeat inputs =============

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so

# you can use different inputs for various configurations.

# Below are the input specific configurations.

- type: log

# filestream is an experimental input. It is going to replace log input in the future.

- type: filestream

# ============================== Filebeat modules ==============================

filebeat.config.modules:

# Glob pattern for configuration loading

path: ${path.config}/modules.d/\*.yml

# Set to true to enable config reloading

reload.enabled: false

# Period on which files under path should be checked for changes

#reload.period: 10s

# == Elasticsearch template setting ===

setup.template.settings:  
index.number\_of\_shards: 1  
#index.codec: best\_compression  
#\_source.enabled: false

# ============= General =================

# The name of the shipper that publishes the network data. It can be used to group

# all the transactions sent by a single shipper in the web interface.

#name:

# The tags of the shipper are included in their own field with each

# transaction published.

#tags: ["service-X", "web-tier"]

# ================================= Dashboards =================================

# The URL from where to download the dashboards archive. By default this URL

# has a value which is computed based on the Beat name and version. For released

# versions, this URL points to the dashboard archive on the [artifacts.elastic.co](http://artifacts.elastic.co)

# website.

#setup.dashboards.url:

# =============================== Elastic Cloud ================================

# These settings simplify using Filebeat with the Elastic Cloud ([https://cloud.elastic.co/](https://cloud.elastic.co/)).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and

# `setup.kibana.host` options.

# You can find the `cloud.id` in the Elastic Cloud web UI.

#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and

# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.

#cloud.auth:

# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------

#output.elasticsearch:

# Array of hosts to connect to.

#hosts: ["localhost:9200"]

# Protocol - either `http` (default) or `https`.

#protocol: "https"

# Authentication credentials - either API key or username/password.

#api\_key: "id:api\_key"  
#username: "elastic"  
#password: "changeme"

# ------------------------------ Logstash Output -------------------------------

output.logstash:

# The Logstash hosts

hosts: ["localhost:5044"]

# Optional SSL. By default is off.

# List of root certificates for HTTPS server verifications

#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]

# Certificate for SSL client authentication

#ssl.certificate: "/etc/pki/client/cert.pem"

# Client Certificate Key

#ssl.key: "/etc/pki/client/cert.key"

# ================================= Processors =================================

processors:

- add\_host\_metadata:  
when.not.contains.tags: forwarded
- add\_cloud\_metadata: ~
- add\_docker\_metadata: ~
- add\_kubernetes\_metadata: ~

# ================================== Logging ===================================

# Sets log level. The default log level is info.

# Available log levels are: error, warning, info, debug

#logging.level: debug

# At debug level, you can selectively enable logging only for some components.

# To enable all selectors use ["\*"]. Examples of other selectors are "beat",

# "publisher", "service".

#logging.selectors: ["\*"]

# ============================= X-Pack Monitoring ==============================

# Filebeat can export internal metrics to a central Elasticsearch monitoring

# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The

# reporting is disabled by default.

# Set to true to enable the monitoring reporter.

#monitoring.enabled: false

# Sets the UUID of the Elasticsearch cluster under which monitoring data for this

# Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch

# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.

#monitoring.cluster\_uuid:

# Uncomment to send the metrics to Elasticsearch. Most settings from the

# Elasticsearch output are accepted here as well.

# Note that the settings should point to your Elasticsearch _monitoring_ cluster.

# Any setting that is not set is automatically inherited from the Elasticsearch

# output configuration, so if you have the Elasticsearch output configured such

# that it is pointing to your Elasticsearch monitoring cluster, you can simply

# uncomment the following line.

#monitoring.elasticsearch:

# ============================== Instrumentation ===============================

# Instrumentation support for the filebeat.

#instrumentation:  
# Set to true to enable instrumentation of filebeat.  
#enabled: false

```
# Environment in which filebeat is running on (eg: staging, production, etc.)
#environment: ""

# APM Server hosts to report instrumentation results to.
#hosts:
# - http://localhost:8200

# API Key for the APM Server(s).
# If api_key is set then secret_token will be ignored.
#api_key:

# Secret token for the APM Server(s).
#secret_token:

```

# ================================= Migration ==================================

# This allows to enable 6.7 migration aliases

#migration.6\_to\_7.enabled: true

My logstash.conf looks like below :-

```
input {

```

beats{  
type =\> "test"  
port=\> "5044"  
}  
}  
output {  
elasticsearch {  
hosts =\> "[http://localhost:9200](http://localhost:9200)"  
index =\> "plwlogbeat"  
}  
stdout { codec =\> rubydebug }  
}

and the error I am getting is :-

C:\ELK\filebeat-7.11.0-windows-x86\_64\>filebeat.exe -e -c fields.yml  
2021-04-07T15:44:55.757+0200 INFO instance/beat.go:660 Home path: [C:\ELK\filebeat-7.11.0-windows-x86\_64] Config path: [C:\ELK\filebeat-7.11.0-windows-x86\_64] Data path: [C:\ELK\filebeat-7.11.0-windows-x86\_64\data] Logs path: [C:\ELK\filebeat-7.11.0-windows-x86\_64\logs]  
2021-04-07T15:44:55.757+0200 INFO instance/beat.go:668 Beat ID: cd8eb170-7035-4cd0-b51c-81024dbc6baa  
2021-04-07T15:44:55.758+0200 INFO [beat] instance/beat.go:996 Beat info {"system\_info": {"beat": {"path": {"config": "C:\ELK\filebeat-7.11.0-windows-x86\_64", "data": "C:\ELK\filebeat-7.11.0-windows-x86\_64\data", "home": "C:\ELK\filebeat-7.11.0-windows-x86\_64", "logs": "C:\ELK\filebeat-7.11.0-windows-x86\_64\logs"}, "type": "filebeat", "uuid": "cd8eb170-7035-4cd0-b51c-81024dbc6baa"}}}  
2021-04-07T15:44:55.759+0200 INFO [beat] instance/beat.go:1005 Build info {"system\_info": {"build": {"commit": "84c4d4c4034fcb49c1a318ccdc7311d70adee15b", "libbeat": "7.11.0", "time": "2021-02-08T22:42:11.000Z", "version": "7.11.0"}}}  
2021-04-07T15:44:55.759+0200 INFO [beat] instance/beat.go:1008 Go runtime info {"system\_info": {"go": {"os":"windows","arch":"amd64","max\_procs":8,"version":"go1.14.14"}}}  
2021-04-07T15:44:55.845+0200 INFO [beat] instance/beat.go:1012 Host info {"system\_info": {"host": {"architecture":"x86\_64","boot\_time":"2021-04-07T09:01:04.88+02:00","name":"PORT-145","ip":["fe80::f9f7:1f19:cad5:c141/64","169.254.193.65/16","fe80::9c8b:a0ef:4837:4a5a/64","169.254.74.90/16","fe80::240d:8d2a:cef4:e2ef/64","192.168.56.1/24","fe80::d5f3:4e64:e909:f888/64","169.254.248.136/16","fe80::8dd2:c1ed:57c9:64/64","169.254.0.100/16","fe80::f13f:f5e5:d4e2:c90c/64","192.168.0.13/24","::1/128","127.0.0.1/8"],"kernel\_version":"10.0.19041.867 (WinBuild.160101.0800)","mac":["68:f7:28:13:bf:68","0a:00:27:00:00:0a","0a:00:27:00:00:32","80:19:34:ad:74:b6","82:19:34:ad:74:b5","80:19:34:ad:74:b5"],"os":{"family":"windows","platform":"windows","name":"Windows 10 Pro","version":"10.0","major":10,"minor":0,"patch":0,"build":"19042.867"},"timezone":"CEST","timezone\_offset\_sec":7200,"id":"3a10ed6d-322b-4fec-8fb8-05100b2b5b7b"}}}  
2021-04-07T15:44:55.846+0200 INFO [beat] instance/beat.go:1041 Process info {"system\_info": {"process": {"cwd": "C:\ELK\filebeat-7.11.0-windows-x86\_64", "exe": "C:\ELK\filebeat-7.11.0-windows-x86\_64\filebeat.exe", "name": "filebeat.exe", "pid": 11588, "ppid": 12652, "start\_time": "2021-04-07T15:44:53.887+0200"}}}  
2021-04-07T15:44:55.847+0200 INFO instance/beat.go:304 Setup Beat: filebeat; Version: 7.11.0  
2021-04-07T15:44:55.848+0200 INFO instance/beat.go:337 No outputs are defined. Please define one under the output section.  
2021-04-07T15:44:55.848+0200 INFO instance/beat.go:437 filebeat stopped.  
2021-04-07T15:44:55.848+0200 ERROR instance/beat.go:971 Exiting: No outputs are defined. Please define one under the output section.  
Exiting: No outputs are defined. Please define one under the output section.

Can you please help me?  
Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2021, 3:58pm UTC](https://discuss.elastic.co/t/filebeat-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/269478/2 "2021-05-05T15:58:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.