# Filebeat not reading logs from log files .Non-zero metrics in the last 30s

**URL:** <https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 10, 2018, 10:18am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323 "2018-07-10T10:18:54Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkshara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkshara/32/48222_2.png) [@pkshara](https://discuss.elastic.co/u/pkshara)\
**Post date:** [July 10, 2018, 10:18am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/1 "2018-07-10T10:18:54Z")

</div>

Hi Team,

I am running filebeat in linux server , i have logstash 2.3 , Es 2.3 version and filebeat 6.2.0 version . Is this the issue with compatibility .

Filebeat config gives the log info as "Non-zero metrics in the last 30s" , it doesnt show any error also.

Can someone please show the path , where the error might be.

TIA

---

<div class="post-metadata">

**Author:** ![pkshara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkshara/32/48222_2.png) [@pkshara](https://discuss.elastic.co/u/pkshara)\
**Post date:** [July 10, 2018, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/2 "2018-07-10T13:31:16Z")

</div>

+add on to the question,

I have installed filebeat on 2 different servers, one in windows and other is on linux machine.

From windows filebeat i am able to parse/read the logs to centralized logstash(2.3.2 version), wherein i am not able to do the same from linux filebeat.

Both the servers i am using 6.2.0 version .

If the compatibility issue is there, then the windows filebeat also shouldn't work right?  
Correct me if my understanding is wrong, and please do suggest what changes can i make.

TIA,

---

<div class="post-metadata">

**Author:** ![mat1010](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mat1010/32/33197_2.png) [@mat1010](https://discuss.elastic.co/u/mat1010)\
**Post date:** [July 10, 2018, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/3 "2018-07-10T14:04:53Z")

</div>

> [@pkshara](#):
>
> I am running filebeat in linux server , i have logstash 2.3 , Es 2.3 version and filebeat 6.2.0 version . Is this the issue with compatibility .

From the [compatibility matrix](https://www.elastic.co/support/matrix#matrix_compatibility) point of view it seems not to be supported.

Could you please post your filebeat config to see if there are issues in the configuration itself?

Do you see anything in the elasticsearch log?

---

<div class="post-metadata">

**Author:** ![pkshara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkshara/32/48222_2.png) [@pkshara](https://discuss.elastic.co/u/pkshara)\
**Post date:** [July 11, 2018, 5:38am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/4 "2018-07-11T05:38:17Z")

</div>

Config File :  
filebeat.prospectors:

- input\_type: log

path:

- /home/ext/filebeat\_logs/server1/serverlogs.log  
multiline.pattern: '^[[:space:]]'  
multiline.negate: false  
multiline.match: after

output.logstash:  
hosts: ["localhost:5044"]  
logging.level: debug

i tested the config file ./filebeat -configtest -e,but it loks fine.

---

<div class="post-metadata">

**Author:** ![pkshara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkshara/32/48222_2.png) [@pkshara](https://discuss.elastic.co/u/pkshara)\
**Post date:** [July 11, 2018, 5:40am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/5 "2018-07-11T05:40:44Z")

</div>

> [@mat1010](#):
>
> From the [compatibility matrix](https://www.elastic.co/support/matrix#matrix_compatibility) point of view it seems not to be supported.

Yeah, but the 6.0 version filebeat is supporting in windows s/m and sending logs to logstash 2.3, but why is the same version is not supporting in linux m/c was my doubt.

---

<div class="post-metadata">

**Author:** ![pkshara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkshara/32/48222_2.png) [@pkshara](https://discuss.elastic.co/u/pkshara)\
**Post date:** [July 11, 2018, 5:44am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/6 "2018-07-11T05:44:57Z")

</div>

Solved .

---

<div class="post-metadata">

**Author:** ![mat1010](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mat1010/32/33197_2.png) [@mat1010](https://discuss.elastic.co/u/mat1010)\
**Post date:** [July 11, 2018, 6:55am UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/7 "2018-07-11T06:55:17Z")

</div>

> [@pkshara](#):
>
> Solved .

Could you let us know what caused the issue?

---

<div class="post-metadata">

**Author:** ![pkshara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkshara/32/48222_2.png) [@pkshara](https://discuss.elastic.co/u/pkshara)\
**Post date:** [July 11, 2018, 5:02pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/8 "2018-07-11T17:02:54Z")

</div>

I was running in wrong method ,

Now i ran sudo dpkg -i filebeat and it worked

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2018, 5:02pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-logs-from-log-files-non-zero-metrics-in-the-last-30s/139323/9 "2018-08-08T17:02:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
