# Filebeat failing

**URL:** <https://discuss.elastic.co/t/filebeat-failing/198473>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 6, 2019, 7:00pm UTC](https://discuss.elastic.co/t/filebeat-failing/198473 "2019-09-06T19:00:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [September 6, 2019, 7:00pm UTC](https://discuss.elastic.co/t/filebeat-failing/198473/1 "2019-09-06T19:00:22Z")

</div>

Hey guys,

**My environment - Dev**

```auto
Master nodes (Elasticsearch & Logstash are installed) x 2
Kibana node (Only Kibana) x 1
All m servers are on CentOS7

```

**Before you ask**

```auto
I can reach my master nodes
Both nodes see eachother
I can access Kibana

```

**What I am trying to achieve**  
Having syslog from Elasticsearch servers sent to my ELK. Why ? To understand how it works and the output from my configuration.

That being said, launching logstash works, but not filebeat.

**Config files**  
_Logstash conf_  
Path: /etc/logstash/conf.d/logstash-syslog.conf

```auto
input {
beats { port => "5044" }
}

filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}

}
output {
elasticsearch {
hosts => ["192.168.131.134:9200","192.168.131.136:9200"]
}
stdout {
codec => rubydebug
}
}

```

**Pipeline conf**

```auto
    pipeline.id: filebeat
    queue.type: persisted
    path.config: "/etc/logstash/conf.d/logstash-syslog.conf"

```

**Filebeat conf**

```auto
filebeat.input:

 - input_type: log
    enabled: true
    paths:
        /var/log/messages
        /var/log/*.log
        /var/log/syslog

setup.kibana:
host: "192.168.131.135:5601"

output.logstash:
hosts: ["192.168.131.134:5044", "192.168.131.136:5044"]

```

Error facing

> Sep 05 15:32:06 elk-prod-1 systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: Unit filebeat.service entered failed state.  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: filebeat.service failed.  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: filebeat.service holdoff time over, scheduling restart.  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: start request repeated too quickly for filebeat.service  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to E...rch..  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: Unit filebeat.service entered failed state.  
> Sep 05 15:32:06 elk-prod-1 systemd[1]: filebeat.service failed.
> 
> -- The start-up result is done.  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.173-0400 INFO instance/beat.go:606 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.174-0400 INFO instance/beat.go:614 Beat ID: 527d101c-82a0-4aa0-b6f2-27ec8b298703  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.174-0400 INFO [seccomp] seccomp/seccomp.go:124 Syscall filter successfully installed  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.174-0400 INFO [beat] instance/beat.go:902 Beat info {"system\_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "527d101c-82a0-4aa0-b6f2-27ec8b298703"}}}  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.174-0400 INFO [beat] instance/beat.go:911 Build info {"system\_info": {"build": {"commit": "a4be71b90ce3e3b8213b616adfcd9e455513da45", "libbeat": "7.3.1", "time": "2019-08-19T19:30:50.000Z", "version": "7.3.1"}}}  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.174-0400 INFO [beat] instance/beat.go:914 Go runtime info {"system\_info": {"go": {"os":"linux","arch":"amd64","max\_procs":2,"version":"go1.12.4"}}}  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.176-0400 INFO instance/beat.go:292 Setup Beat: filebeat; Version: 7.3.1  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.177-0400 INFO [publisher] pipeline/module.go:97 Beat name: elk-prod-1  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.177-0400 INFO instance/beat.go:385 filebeat stopped.  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: 2019-09-05T14:46:44.177-0400 ERROR instance/beat.go:877 Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?  
> Sep 05 14:46:44 elk-prod-1 filebeat[2150]: Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?  
> Sep 05 14:46:44 elk-prod-1 systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE  
> Sep 05 14:46:44 elk-prod-1 systemd[1]: Unit filebeat.service entered failed state.  
> Sep 05 14:46:44 elk-prod-1 systemd[1]: filebeat.service failed.  
> Sep 05 14:46:44 elk-prod-1 systemd[1]: filebeat.service holdoff time over, scheduling restart.  
> Sep 05 14:46:44 elk-prod-1 systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..

---

<div class="post-metadata">

**Author:** ![NewmazN24](https://avatars.discourse-cdn.com/v4/letter/n/b77776/32.png) [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\
**Post date:** [September 9, 2019, 1:39pm UTC](https://discuss.elastic.co/t/filebeat-failing/198473/2 "2019-09-09T13:39:40Z")

</div>

Found the answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2019, 1:39pm UTC](https://discuss.elastic.co/t/filebeat-failing/198473/3 "2019-10-07T13:39:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.