# Filebeat is not sending logs to elastic search

**URL:** <https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/190099>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 11, 2019, 7:22pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/190099 "2019-07-11T19:22:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pmilton](https://avatars.discourse-cdn.com/v4/letter/p/5e9695/32.png) [@pmilton](https://discuss.elastic.co/u/pmilton)\
**Post date:** [July 11, 2019, 7:22pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/190099/1 "2019-07-11T19:22:59Z")

</div>

Hi,

I am new to ELK stack and I am trying to setup ELK stack for logging in Azure. I completed the setup at filebeat and it is running.

[elkclient1@elkclient1 /]$ sudo service filebeat restart  
Restarting filebeat (via systemctl): [OK]

My filebeat configurations are

filebeat:  
prospectors:  
-  
paths:  
- /var/log/secure  
- /var/log/messages  
# - /var/log/\*.log

```
  input_type: log
  
  document_type: syslog

```

registry\_file: /var/lib/filebeat/registry

output:  
logstash:  
hosts: ["elk\_server\_private\_ip:5044"]  
bulk\_max\_size: 1024

```
tls:
  certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

```

shipper:

logging:  
files:  
rotateeverybytes: 10485760 # = 10MB

I can see syslog in the new VM I created in Azure but when I test from elastic search server I get the below output

{  
"took" : 1,  
"timed\_out" : false,  
"\_shards" : {  
"total" : 0,  
"successful" : 0,  
"failed" : 0  
},  
"hits" : {  
"total" : 0,  
"max\_score" : 0.0,  
"hits" :   
}  
}

How do I get logs to go to logstash?

The setup I used is [https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7)

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [July 12, 2019, 12:53am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/190099/2 "2019-07-12T00:53:28Z")

</div>

Can you share the logstash configurations?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2019, 12:53am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-elastic-search/190099/3 "2019-08-09T00:53:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.