# Filebeat logging directly to elasticsearch

**URL:** <https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 7, 2016, 10:32am UTC](https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638 "2016-03-07T10:32:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbst83r](https://avatars.discourse-cdn.com/v4/letter/m/919ad9/32.png) [@mbst83r](https://discuss.elastic.co/u/mbst83r)\
**Post date:** [March 7, 2016, 10:32am UTC](https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638/1 "2016-03-07T10:32:36Z")

</div>

Hi guys,

i am trying to log from filebeat directly to elasticsearch. Could it be possible that this feature isn't working properly at all?

I get no erros on startup, during the run and on shutdown, even not in debug mode. Also no data hit's up in my elasticsearch cluster.

Configuration is pretty straight forward, so i think there is really no problem with that. Version is 1.1.1 for Fedora or centos, both OS the same.

......  
output:

### Elasticsearch as output

elasticsearch:  
hosts: ["192.168.178.154:9200,192.168.178.155:9200,192.168.178.161:9200"]  
......

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 7, 2016, 12:43pm UTC](https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638/2 "2016-03-07T12:43:15Z")

</div>

Don't you have any indentation in your configuration file, i.e. is it really

```nohighlight
output:
elasticsearch:
hosts: ...

```

rather than

```nohighlight
output:
  elasticsearch:
    hosts: ...

```

?

---

<div class="post-metadata">

**Author:** ![mbst83r](https://avatars.discourse-cdn.com/v4/letter/m/919ad9/32.png) [@mbst83r](https://discuss.elastic.co/u/mbst83r)\
**Post date:** [March 7, 2016, 1:10pm UTC](https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638/3 "2016-03-07T13:10:09Z")

</div>

It has the indentation, like in your second example. It works now, it was just a different index in Kibana.

Thanks anyway.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/filebeat-logging-directly-to-elasticsearch/43638/4 "2017-07-05T21:54:52Z")

</div>