# Filebeat not publishing to logstash **URL:** \ **Category:** Beats\ **Created:** [September 14, 2016, 8:23am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468 "2016-09-14T08:23:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Post date:** [September 14, 2016, 8:23am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468/1 "2016-09-14T08:23:31Z")
hi there i have filebeat alpha 5.0 when i try to publish it directly to elasticsearch everythin works fine but when i change the output to logstash no data is comming through and i get the following errors 2016-09-14T11:14:18+03:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.write\_bytes=6471 libbeat.publisher.published\_events=60 libbeat.logstash.publish.read\_bytes=48 libbeat.logstash.published\_and\_acked\_events=60 publish.events=60 registrar.state\_updates=1110 libbeat.logstash.published\_but\_not\_acked\_events=16 libbeat.logstash.publish.read\_errors=2 libbeat.logstash.call\_count.PublishEvents=7 2016-09-14T11:14:43+03:00 ERR Failed to publish events caused by: EOF 2016-09-14T11:14:43+03:00 INFO Error publishing events (retrying): EOF 2016-09-14T11:14:48+03:00 INFO Non-zero metrics in the last 30s: libbeat.publisher.published\_events=56 libbeat.logstash.published\_and\_acked\_events=56 registrar.state\_updates=888 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.call\_count.PublishEvents=5 libbeat.logstash.publish.read\_bytes=30 publish.events=56 libbeat.logstash.publish.write\_bytes=4747 libbeat.logstash.published\_but\_not\_acked\_events=10 2016-09-14T11:14:58+03:00 ERR Failed to publish events caused by: EOF 2016-09-14T11:14:58+03:00 INFO Error publishing events (retrying): EOF 2016-09-14T11:15:18+03:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.read\_bytes=48 libbeat.logstash.call\_count.PublishEvents=5 registrar.state\_updates=888 libbeat.logstash.publish.write\_bytes=15983 libbeat.logstash.published\_and\_acked\_events=141 libbeat.publisher.published\_events=141 libbeat.logstash.published\_but\_not\_acked\_events=18 publish.events=141 2016-09-14T11:15:23+03:00 ERR Failed to publish events caused by: EOF 2016-09-14T11:15:23+03:00 INFO Error publishing events (retrying): EOF 2016-09-14T11:15:35+03:00 ERR Failed to publish events caused by: EOF 2016-09-14T11:15:35+03:00 INFO Error publishing events (retrying): EOF 2016-09-14T11:15:48+03:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=7 libbeat.logstash.publish.write\_bytes=5852 libbeat.publisher.published\_events=57 libbeat.logstash.published\_and\_acked\_events=57 libbeat.logstash.publish.read\_errors=2 libbeat.logstash.published\_but\_not\_acked\_events=12 libbeat.logstash.publish.read\_bytes=36 registrar.state\_updates=1110 publish.events=57 2016-09-14T11:15:50+03:00 ERR Failed to publish events caused by: EOF 2016-09-14T11:15:50+03:00 INFO Error publishing events (retrying): EOF 2016-09-14T11:16:18+03:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.write\_bytes=5389 libbeat.logstash.published\_and\_acked\_events=58 libbeat.logstash.published\_but\_not\_acked\_events=22 registrar.state\_updates=888 libbeat.logstash.publish.read\_errors=1 libbeat.logstash.publish.read\_bytes=36 libbeat.logstash.call\_count.PublishEvents=5 libbeat.publisher.published\_events=58 publish.events=58 2016-09-14T11:16:48+03:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.published\_and\_acked\_events=56 publish.events=56 libbeat.publisher.published\_events=56 registrar.state\_updates=1110 libbeat.logstash.call\_count.PublishEvents=5 libbeat.logstash.publish.write\_bytes=4172 libbeat.logstash.publish.read\_bytes=30 ---
**Author:** ![gilisade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gilisade/32/98740_2.png) [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Post date:** [September 14, 2016, 8:26am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468/2 "2016-09-14T08:26:49Z")
this is my yml file ```auto filebeat.prospectors: - input_type: log paths: - /path/to/logs/1 fields: log_type: "test1" ignore_older: "336h" multiline.pattern: '^(?:0?[1-9]|1[0-2])' multiline.negate: true multiline.match: after - input_type: log paths: - /path/to/logs/2 fields: log_type: "test2" ignore_older: "336h" multiline.pattern: '^(?:0?[1-9]|1[0-2])' multiline.negate: true multiline.match: after - input_type: log paths: - /path/to/logs/3 fields: log_type: "test3" ignore_older: "336h" multiline.pattern: '^(?:0?[1-9]|1[0-2])' multiline.negate: true multiline.match: after - input_type: log paths: - /path/to/logs/4 fields: log_type: "test4" ignore_older: "336h" multiline.pattern: '^(?:0?[1-9]|1[0-2])' multiline.negate: true multiline.match: after output.logstash: hosts: ["logstashserver:5044"] ``` any help ? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [September 14, 2016, 11:16am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468/3 "2016-09-14T11:16:23Z")
please format your configs using the `` button. Beats config file format is sensitive to indentation and without proper formatting it's hard to read/check your config. Seems the connection is closed by logstash. Check logstash logs. How is your logstash beats input configured? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [September 15, 2016, 6:13am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468/4 "2016-09-15T06:13:07Z")
I applied the formatting ---
**Author:** ![chris.mcdermott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chris.mcdermott/32/22662_2.png) [@chris.mcdermott](https://discuss.elastic.co/u/chris.mcdermott)\ **Post date:** [September 28, 2016, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468/5 "2016-09-28T16:14:48Z")
Any update on this? I am seeing the same problem. In my case some of the data is making it to logstash, but not all of it. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [October 3, 2016, 7:33am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468/6 "2016-10-03T07:33:31Z")
@chris.mcdermott Can you please share some more details? LS / FB version, Config files, logs, ...? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 5, 2016, 8:23am UTC](https://discuss.elastic.co/t/filebeat-not-publishing-to-logstash/60468/7 "2016-10-05T08:23:40Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.