# Filebeat failed to start in PCF

**URL:** <https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [March 28, 2021, 7:39pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603 "2021-03-28T19:39:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgzwarrior](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mgzwarrior/32/86206_2.png) [@mgzwarrior](https://discuss.elastic.co/u/mgzwarrior)\
**Post date:** [March 28, 2021, 7:39pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603/1 "2021-03-28T19:39:13Z")

</div>

Filebeat is failing to start with the following error.

`ERR Exiting: fileset okta/system is configured but doesn't exist`

I am attempting to run filebeat as an application in PCF with the input being sys logs from Okta (using the okta filebeat module) and the output being a standard Elasticsearch cluster.

Any suggestions would be appreciated, I would be happy to provide more info as requested.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 28, 2021, 11:00pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603/2 "2021-03-28T23:00:56Z")

</div>

Perhaps share your `manifest.yml`.

Did you `cf push` from the top directory that you untared the Linux Filebeat tar.gz.. the directory that `filebeat*` is in , all that needs to be pushed up not just the executable.

Also you will need to run `./filebeat setup` before you `cf push` to PCF assuming you want to load the Okta templates , dashboards etc.

Here is my sample manifest

```
applications:
- name: filebeat
  memory: 1G
  instances: 2
  buildpacks:
  - binary_buildpack
  command: ./filebeat -e -c ~/filebeat.yml
  stack: cflinuxfs3
  health-check-type: process
  no-route: true

```

Run from this directory / location

```
ceres:sandbox sbrown$ cd filebeat-7.11.2-linux-x86_64
LICENSE.txt fields.yml filebeat.yml manifest.yml
NOTICE.txt filebeat* filebeat.yml.org module/
README.md filebeat.reference.yml kibana/ modules.d/

```

`ceres:sandbox sbrown$ tar -xvf filebeat-7.11.2-linux-x86_64.tar.gz`

`ceres:sandbox sbrown$ cd filebeat-7.11.2-linux-x86_64`

`ceres:filebeat-7.11.2-linux-x86_64 sbrown$ ./filebeat setup`

`ceres:filebeat-7.11.2-linux-x86_64 sbrown$ cf push`

All that works then you may or may not have connectivity to the OKTA endpoint and the Elasticsearch endpoint, I assume you have accounted for that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2021, 1:01am UTC](https://discuss.elastic.co/t/filebeat-failed-to-start-in-pcf/268603/3 "2021-04-26T01:01:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.