# Filebeat is not sending the logs to the logstash **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 23, 2018, 7:53am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101 "2018-07-23T07:53:18Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![siva1](https://avatars.discourse-cdn.com/v4/letter/s/91b2a8/32.png) [@siva1](https://discuss.elastic.co/u/siva1)\ **Post date:** [July 23, 2018, 7:53am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101/1 "2018-07-23T07:53:18Z")
Hi All, I am using filebeat and ELK stack. I am not getting any logs from the filebeat to Logstash. Can anyone help me. Its very urgent. Filebeat version : 6.0.0 ELK stack(sebp/elk) : 6.0.0 Filebeat.config :-- filebeat.prospectors: - type: log enabled: true paths: - '/var/lib/docker/containers/_/_.log' ignore\_older: 0 scan\_frequency: 10s json.message\_key: log json.keys\_under\_root: true json.add\_error\_key: true multiline.pattern: "^[[:space:]]+(at|\.{3})\b|^Caused by:" multiline.negate: false multiline.match: after registry\_file: usr/share/filebeat/data/registry output.logstash: hosts: ["14.315.344.174:5044"] Filebeat logs :--- 2018/07/23 07:43:48.883641 beat.go:426: INFO Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs] 2018/07/23 07:43:48.883754 metrics.go:23: INFO Metrics logging every 30s 2018/07/23 07:43:48.885007 beat.go:433: INFO Beat UUID: 8f0f82c8-e460-46e9-8d96-a6fdc8364ca2 2018/07/23 07:43:48.885042 beat.go:192: INFO Setup Beat: filebeat; Version: 6.0.0 2018/07/23 07:43:48.885553 module.go:80: INFO Beat name: 1999258b635b 2018/07/23 07:43:48.886031 beat.go:260: INFO filebeat start running. 2018/07/23 07:43:48.886112 registrar.go:71: INFO No registry file found under: /usr/share/filebeat/data/registry. Creating a new registry file. 2018/07/23 07:43:48.887555 registrar.go:108: INFO Loading registrar data from /usr/share/filebeat/data/registry 2018/07/23 07:43:48.887605 registrar.go:119: INFO States Loaded from registrar: 0 2018/07/23 07:43:48.887630 filebeat.go:260: WARN Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning. 2018/07/23 07:43:48.887663 crawler.go:44: INFO Loading Prospectors: 1 2018/07/23 07:43:48.887795 registrar.go:150: INFO Starting Registrar 2018/07/23 07:43:48.888355 prospector.go:103: INFO Starting prospector of type: log; id: 2696038032251986622 2018/07/23 07:43:48.888387 crawler.go:78: INFO Loading and starting Prospectors completed. Enabled prospectors: 1 2018/07/23 07:44:18.884245 metrics.go:39: INFO Non-zero metrics in the last 30s: beat.memstats.gc\_next=4473924 beat.memstats.memory\_alloc=3036536 beat.memstats.memory\_total=3036536 filebeat.harvester.open\_files=0 filebeat.harvester.running=0 libbeat.config.module.running=0 libbeat.output.type=logstash libbeat.pipeline.clients=1 libbeat.pipeline.events.active=0 registrar.states.current=0 registrar.writes=1 ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [July 23, 2018, 10:12am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101/2 "2018-07-23T10:12:05Z")
Could you please format your using ``, so if you have configuration problems it can be detected? ---
**Author:** ![siva1](https://avatars.discourse-cdn.com/v4/letter/s/91b2a8/32.png) [@siva1](https://discuss.elastic.co/u/siva1)\ **Post date:** [July 24, 2018, 5:18am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101/3 "2018-07-24T05:18:59Z")
Hi @kvch Noémi Ványi Thanks for reply. Here my formatted code. ## Filebeat.yml:- ``` - type: log enabled: true paths: - '/var/lib/docker/containers/*/*.log' ignore_older: 0 scan_frequency: 10s json.message_key: log json.keys_under_root: true json.add_error_key: true multiline.pattern: "^[[:space:]]+(at|\\.{3})\\b|^Caused by:" multiline.negate: false multiline.match: after registry_file: usr/share/filebeat/data/registry ``` ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 24, 2018, 11:59am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101/4 "2018-07-24T11:59:11Z")
Hi, I am facing simllar problem, it was working completely fine till last night, since then filebeat is not sending any input to logstash. ---
**Author:** ![Nithani25](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nithani25/32/33457_2.png) [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Post date:** [July 24, 2018, 12:01pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101/5 "2018-07-24T12:01:26Z")
the only recent change which i did was taking a sample file and created index pattern to verify the multiline pattern settings, upon reading the messages, i deleted that index to create the actual one with production files. SInce then i have been facing this problem. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [July 25, 2018, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101/6 "2018-07-25T16:45:37Z")
Could you please both share debug logs? @siva1 What changed before Filebeat failed to send logs? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2018, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-the-logs-to-the-logstash/141101/7 "2018-08-22T16:45:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.