# Filebeat harvester started but not sending logs to logstash / kibana
**URL:** https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030
**Category:** Elasticsearch
**Created:** [January 2, 2021, 10:20pm UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030 "2021-01-02T22:20:51Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)
#### Post date: [January 2, 2021, 10:20pm UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/1 "2021-01-02T22:20:51Z")
I'm certainly missing something in my configuration. I'm running a full docker setup, and can access Kibana and view indexes, including some logs I manually sent to logstash, I'm working on adding filebeat, docker logs seem to show it connects to logstash, and I even get harvester started for my log file, and additional logs if I update my log file, however the Non-zero metrics in the last 30s show nothing about my logs and nothing is making it to logstash / kibana index view. I have only configured a basic input/output as such in my filebeat.yml
```auto
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
filebeat.inputs:
- type: log
enabled: true
paths:
- /projects/dealseal/oppty-re-server/log/2021/1/*.log
output.logstash:
enabled: true
hosts: ["logstash:5044"]
```
I have not done anything in my logstash.yml other then:
```auto
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: ["http://elasticsearch:9200"]
## X-Pack security credentials
#
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: changeme
```
Any ideas why my logs would not be sent to logstash correctly?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [January 3, 2021, 5:14am UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/2 "2021-01-03T05:14:46Z")
What do the Filebeat logs show?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 3, 2021, 6:01am UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/3 "2021-01-03T06:01:50Z")
What does your Logstash config look like? You need to create a pipeline with at least a beats input listening to port 5044 and an elasticsearch output as Logstash does nothing by default or without a configuration. It might be easier to have Filebeat write directly to Elasticsearch.
---
### Author:  [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)
#### Post date: [January 3, 2021, 8:21pm UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/4 "2021-01-03T20:21:31Z")
lostash.conf file is below: I added the filter to handle an error, which allowed a bunch of docker logs to flow through, however that did not solve my problem with the log file from filebeats, I'm confused if "beats" and "filebeat" are the same thing / input.
```auto
input {
beats {
port => 5044
}
tcp {
port => 5000
}
}
## Add your filters / logstash plugins configuration here
filter {
mutate { replace => { "[host]" => "[host][name]" } }
}
output {
elasticsearch {
hosts => "elasticsearch:9200"
user => "elastic"
password => "changeme"
ecs_compatibility => disabled
}
}
```
---
### Author:  [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)
#### Post date: [January 3, 2021, 8:26pm UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/5 "2021-01-03T20:26:01Z")
>
notice: Harvester started for file: /projects/dealseal/oppty-re-server/log/2021/1/debug-2021-1-2.log
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [January 3, 2021, 10:46pm UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/6 "2021-01-03T22:46:57Z")
I looked at your log but it ends right after Filebeat finally connects to Logstash what does the logs look like after that?... Are there new log events being written to the harvested file?
---
### Author:  [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)
#### Post date: [January 3, 2021, 11:47pm UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/7 "2021-01-03T23:47:09Z")
I added logs to my gist post as a comment. You know, it started reporting in. Maybe I fixed it adding mutate { replace =\> { "[host]" =\> "[host][name]" } } which was failing for docker logs. I'm going to makr this answered, thanks for everyones support.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [January 4, 2021, 12:04am UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/8 "2021-01-04T00:04:13Z")
Yes since there was no if / conditional logic for that mutate if it failed on every event then all the events would be lost ... If I am understanding correct.
There also looked like very few events being harvested
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 1, 2021, 12:04am UTC](https://discuss.elastic.co/t/filebeat-harvester-started-but-not-sending-logs-to-logstash-kibana/260030/9 "2021-02-01T00:04:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.