# Filebeat fails to start in ubuntu 16.04

**URL:** <https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 14, 2017, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418 "2017-04-14T14:37:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![praveen133t](https://avatars.discourse-cdn.com/v4/letter/p/43a26b/32.png) [@praveen133t](https://discuss.elastic.co/u/praveen133t)\
**Post date:** [April 14, 2017, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418/1 "2017-04-14T14:37:42Z")

</div>

When I try to start `filebeat` using `sudo service filebeat start` it does not throw any error. But when I do `sudo service filebeat status` I see the following error

```
● filebeat.service - filebeat
   Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
   Active: inactive (dead) (Result: exit-code) since Fri 2017-04-14 09:16:22 EDT; 45min ago
     Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
  Process: 1313 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE)
 Main PID: 1313 (code=exited, status=1/FAILURE)

Apr 14 09:16:21 ip-10-94-0-4 systemd[1]: filebeat.service: Unit entered failed state.
Apr 14 09:16:21 ip-10-94-0-4 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Apr 14 09:16:22 ip-10-94-0-4 systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
Apr 14 09:16:22 ip-10-94-0-4 systemd[1]: Stopped filebeat.
Apr 14 09:16:22 ip-10-94-0-4 systemd[1]: filebeat.service: Start request repeated too quickly.
Apr 14 09:16:22 ip-10-94-0-4 systemd[1]: Failed to start filebeat.

```

I also checked the config yaml using the following command `filebeat -configtest -c filebeat.yml` I don't see any errors.

My `filebeat.yml` is as follows

```
filebeat:
  prospectors:
    path:
      - /var/log/auth.log
      - /var/log/syslog
      - /var/log/tomcat8/catalina.out
    input_type: log
    document_type: syslog
  registry_file: /var/lib/filebeat/registry
output:
  logstash:
    hosts:
      - '10.10.0.226:5044'
    bulk_max_size: 1024
    tls:
      certificate_authorities:
        - /etc/pki/tls/certs/logstash-forwarder.crt
shipper: null
logging:
  to_files: false
  files:
    path: /var/log/mybeat
    name: mybeat
    rotateeverybytes: 10485760
    keepfiles: 3
  level: info
```

---

<div class="post-metadata">

**Author:** ![praveen133t](https://avatars.discourse-cdn.com/v4/letter/p/43a26b/32.png) [@praveen133t](https://discuss.elastic.co/u/praveen133t)\
**Post date:** [April 14, 2017, 3:01pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418/2 "2017-04-14T15:01:22Z")

</div>

Never mind. It was a configuration issue. I was able to figure it out.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 14, 2017, 3:02pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418/3 "2017-04-14T15:02:19Z")

</div>

Could you add a `-e` on there? Like `filebeat -configtest -c filebeat.yml -e` and try that again.

Have you checked the logfile to see what it says?

What version of Filebeat is this?

---

<div class="post-metadata">

**Author:** ![praveen133t](https://avatars.discourse-cdn.com/v4/letter/p/43a26b/32.png) [@praveen133t](https://discuss.elastic.co/u/praveen133t)\
**Post date:** [April 14, 2017, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418/4 "2017-04-14T15:03:21Z")

</div>

Andrew,

I mentioned the `path` in yml incorrectly. It should have been `paths` and also another indentation issue. I figured it out. Thanks a lot for your response.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2017, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-start-in-ubuntu-16-04/82418/5 "2017-05-12T15:05:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.