# Filebeat is not sending logs to logstash **URL:** \ **Category:** Logstash\ **Created:** [July 24, 2016, 7:29pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249 "2016-07-24T19:29:18Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [July 24, 2016, 7:29pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/1 "2016-07-24T19:29:18Z")
There are some sample apache logs in folder listed in paths, but still they not going to logstash Here is my configuration, _ **filebeat** :_ ``` filebeat: prospectors: - paths: - /home/saurabh/sample-log/*.log" input_type: log registry_file: /var/lib/filebeat/registry output: logstash: hosts: ["localhost:5044"] console: pretty: true shipper: logging: to_files: true files: path: /var/log/filebeat name: mybeat rotateeverybytes: 10485760 # = 10MB ``` _ **logstash** :_ ``` input { beats { port => 5044 } stdin { } } filter{ grok { match => ["message", "%{COMBINEDAPACHELOG}"] } date { match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] } geoip { source => "clientip" target => "geoip" database => "/home/saurabh/Documents/GeoLiteCity.dat" add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}"] add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}"] } mutate { convert => ["[geoip][coordinates]", "float"] } } output { stdout { codec => rubydebug } elasticsearch { manage_template => false **hosts => "localhost:9200"** } } ``` Thank you. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 24, 2016, 10:45pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/2 "2016-07-24T22:45:58Z")
Are they making it to `stdout`? Is there anything in the beats logs? What versions are you on? ---
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [July 25, 2016, 7:22am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/3 "2016-07-25T07:22:38Z")
Nothing is in beats logs as well as stdout. I am using the latest version - filebeat\_1.2.3\_amd64 Please correct me if i am wrong, the **default ports** use by, - elasticsearch: 9200 - kibana: 5601 - logstash: 5000 - filebeat 5044 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 25, 2016, 7:55am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/4 "2016-07-25T07:55:11Z")
Versions, not ports 🙂 ---
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [July 25, 2016, 8:05am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/5 "2016-07-25T08:05:52Z")
I am using the latest version - **filebeat\_1.2.3\_amd64** elasticsearch-2.3.4 logstash\_2.3.4-1\_all kibana\_4.5.2\_amd64 I also want to know that am I using correct ports? ---
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [July 26, 2016, 6:02am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/6 "2016-07-26T06:02:43Z")
@warkolm please tell me why my logs are not going to logstash. and how to startfeat with stdout. thanks. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 26, 2016, 7:02am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/7 "2016-07-26T07:02:18Z")
This sounds like a beats issue, I'd move the thread there to see if you can get some assitance. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 27, 2016, 1:30pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/8 "2016-07-27T13:30:36Z")
Filebeat's output port needs to be the same as Logstash's input port. It doesn't matter if you pick 5000, 5044, or something else, but they must be the same. There might be other problems with your configuration but start by addressing this. ---
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [July 27, 2016, 1:33pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/9 "2016-07-27T13:33:25Z")
@magnusbaeck Thank you for this. I realized that and made changes accordingly. My config file has same ports as you said. Sorry I didnt updated this in question. But still it is not working. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 27, 2016, 1:45pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/10 "2016-07-27T13:45:07Z")
Perhaps Filebeat is tailing the input files and waiting for more data to be added to them? Also, should there really be a lone double quote at the end of the filename pattern? ``` - /home/saurabh/sample-log/*.log" ``` ---
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [July 27, 2016, 1:54pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/11 "2016-07-27T13:54:33Z")
@magnusbaeck Its working. Thank you. You are lifesaver 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-to-logstash/56249/12 "2017-07-06T04:46:17Z")