[root@ip- ~]# sudo systemctl enable filebeat
[root@ip- ~]# sudo systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Fri 2019-09-06 10:20:30 UTC; 1h 49min ago
Docs: https://www.elastic.co/products/beats/filebeat
Main PID: 4047 (code=exited, status=1/FAILURE)
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: Unit filebeat.service entered failed state.
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: filebeat.service failed.
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: filebeat.service holdoff time over, scheduling restart.
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: start request repeated too quickly for filebeat.service
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: Unit filebeat.service entered failed state.
Sep 06 10:20:30 ip-.ec2.internal systemd[1]: filebeat.service failed.