# Filebeat Installation 0 hits? Troubleshoot

**URL:** <https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 11, 2016, 2:57pm UTC](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784 "2016-05-11T14:57:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leonard\_Larios\_Chan](https://avatars.discourse-cdn.com/v4/letter/l/958977/32.png) [@Leonard\_Larios\_Chan](https://discuss.elastic.co/u/Leonard_Larios_Chan)\
**Post date:** [May 11, 2016, 2:57pm UTC](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784/1 "2016-05-11T14:57:22Z")

</div>

Hi!

I'm new to using the ELK stack and after configuring, installing the ELK stack and finally coming to filebeat, I can't seem to get a hit after running

curl -XGET '[http://localhost:9200/filebeat-\*/\_search?pretty](http://localhost:9200/filebeat-*/_search?pretty)'

and getting

{  
"\_index" : "filebeat-2016.01.29",  
"\_type" : "log",  
"\_id" : "AVKO98yuaHvsHQLa53HE",  
"\_score" : 1.0,  
"\_source":{"message":"Feb 3 14:34:00 rails sshd[963]: Server listening on :: port 22.","@version":"1","@timestamp":"2016-01-29T19:59:09.145Z","beat":{"hostname":"topbeat-u-03","name":"topbeat-u-03"},"count":1,"fields":null,"input\_type":"log","offset":70,"source":"/var/log/auth.log","type":"log","host":"topbeat-u-03"}  
}

like I'm supposed to. I am getting

{  
"took" : 1  
"timed\_out" : false,  
"\_shards" : {  
"total" : 0,  
"successful" : 0,  
"failed" : 0  
},  
"hits" : {  
"total" : 0  
"max\_score" : 0.0,  
"hits" : []  
}  
}

This is my first time trying this ELK stack as part of my own learning and would appreciate if someone could help me!

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 11, 2016, 10:20pm UTC](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784/2 "2016-05-11T22:20:33Z")

</div>

you using filebeat-\>logstash-\>elastisearch or filebeat-\>elasticsearch? How does your config look like? Any error messages from filebeat/logstash? Have you tried running filebeat directly on console in debug mode (add `-d '*' -v -e`)?

---

<div class="post-metadata">

**Author:** ![Leonard\_Larios\_Chan](https://avatars.discourse-cdn.com/v4/letter/l/958977/32.png) [@Leonard\_Larios\_Chan](https://discuss.elastic.co/u/Leonard_Larios_Chan)\
**Post date:** [May 12, 2016, 1:19am UTC](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784/3 "2016-05-12T01:19:14Z")

</div>

Hi! Thanks for responding!

I believe I am using filebeat \> logstash \> Elasticsearch as I'm required to setup an ELK. (please correct me if I'm wrong in doing that. I'm currently also following a guide on digitialocean and did follow it. my config is as per the website, There were no error messages from the filebeat/logstash.

I will try to run filbeat directly in debug mode.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 12, 2016, 11:58am UTC](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784/4 "2016-05-12T11:58:43Z")

</div>

which guide. There is another [official getting-started guide](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/filebeat-installation-0-hits-troubleshoot/49784/5 "2017-07-05T21:52:05Z")

</div>