# Filebeat is not writing logs when I try to start filebeat service

**URL:** <https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 23, 2019, 3:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439 "2019-01-23T15:46:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![janu](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@janu](https://discuss.elastic.co/u/janu)\
**Post date:** [January 23, 2019, 3:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/1 "2019-01-23T15:46:05Z")

</div>

When I try to start the filebeat service it is throwing Error 1053 and I don't see logs that are written for this error. Can you please help

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 24, 2019, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/2 "2019-01-24T13:37:24Z")

</div>

Which operating system are you using? Filebeat version? How exactly do you start up filebeat?

---

<div class="post-metadata">

**Author:** ![janu](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@janu](https://discuss.elastic.co/u/janu)\
**Post date:** [January 24, 2019, 3:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/3 "2019-01-24T15:46:21Z")

</div>

Hi Steffens,

Thank you for replying me. I use windows 2012 R2 64-bit OS and filebeat version is 6.5.4. I use services.msc to start filebeat service. Now I can start the service and its running successfully but could see nothing in logs. Now I'm stuck what actually happens when all components like elastic search, logstash, Kibana and filebeat services are running. I'm attaching my filebeat.yml and firstpipeline.conf file (which I created in logstash folder) from logstash

**Filebeat.yml:**

```auto
filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log
  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
  - E:\log_archive\archive\USSBYPID1200301-18-2019--01-30-7-PM.zip\server.log
    #- c:\programdata\elasticsearch\logs\*
output.logstash:
  #The Logstash hosts
  hosts: ["localhost:5044"]

**Firstpipeline.conf from logstash config folder:**

# List of pipelines to be loaded by Logstash
#
# 

input {
    beats {
        port => "5044"
    }
}
# The filter part of this file is commented out to indicate that it is
# optional.
# filter {
#
# }
output {
    elasticsearch {
        hosts => ["localhost:9200"]
    }
}

```

I accessed [http://localhost:5044](http://localhost:5044) but I'm getting 'site can't be reached error' and I don't find any logs folder under logstash, i assume we have to create and point it in the above code under input but sure. If I hit [http://localhost:9200](http://localhost:9200), I'm getting a sample jason file with some matter which stated elastic search is working but not logs.

Please help me with it

---

<div class="post-metadata">

**Author:** ![janu](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@janu](https://discuss.elastic.co/u/janu)\
**Post date:** [January 24, 2019, 4:12pm UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/4 "2019-01-24T16:12:14Z")

</div>

I added these two lines also in my filebeat.yml file under enable:true which is like before paths

```auto
include_lines: ["ERROR"]
  *ignore-older: "24d" 

```

so now the lines which are enabled in that file are like this

filebeat.inputs:

```auto
- type: log
  
  enabled: true
  include_lines: ["ERROR"]
  *ignore-older: "24d" 
  
  paths:
   - 'E:\log_archive\archive\USSBYPID1200301-18-2019--01-30-7-PM.zip\*.log'
   
output.logstash:
   hosts: ["localhost:5044"]

```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 25, 2019, 12:17pm UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/5 "2019-01-25T12:17:39Z")

</div>

Please properly format logs and config files using the `</>` button. YAML is sensitive to indentation and this forum uses markdown. It's difficult to spot config error without proper formatting.

> I accessed [http://localhost:5044](http://localhost:5044) but I'm getting 'site can't be reached error' and I don't find any logs folder under logstash

The beats input does not use HTTP. It uses the lumberjack protocol, which sits on top of TCP. You can use telnet to check if the port is available from your filebeat host.

Why do you need Logstash, given your very minimal Logstash configuration?

> Now I'm stuck what actually happens when all components like Elasticsearch, logstash, Kibana and filebeat services are running.

Where exactly are you stuck? Can you share filebeat logs?

---

<div class="post-metadata">

**Author:** ![janu](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@janu](https://discuss.elastic.co/u/janu)\
**Post date:** [January 25, 2019, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/6 "2019-01-25T13:53:16Z")

</div>

How to check if port is available from my filebeat host?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [January 29, 2019, 6:28am UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/7 "2019-01-29T06:28:24Z")

</div>

have you tried with telnet?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2019, 6:28am UTC](https://discuss.elastic.co/t/filebeat-is-not-writing-logs-when-i-try-to-start-filebeat-service/165439/8 "2019-02-26T06:28:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.