# Filebeat not sending/error sending data to logstash

**URL:** <https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 8, 2022, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005 "2022-09-08T15:14:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_96](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@alex\_96](https://discuss.elastic.co/u/alex_96)\
**Post date:** [September 8, 2022, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005/1 "2022-09-08T15:14:49Z")

</div>

Hello, I'm trying to send mysql logs to logstash, initially there was only logstash configuration, but I ran into the fact that filebeat sent messages in encoded form, so I had to redo the filebeat config, here it is:

```auto
# ============================== Filebeat inputs ===============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

# filestream is an input for collecting log messages from files.
- type: filestream

  # Unique ID among all inputs, an ID is required.
  #id: 55

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /home/user/test.log
  parsers:
    - multiline:
        type: pattern
        pattern: '^#%{SPACE}Time:%{SPACE}%{TIMESTAMP_ISO8601:time}'
        negate: true
        match: after

```

Logstash config:

```auto
input {
  beats {
   port => 5044
  }
 }
filter {
    grok {
......
output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

```

Log example:

```auto
# Time: 2022-09-08T01:17:01.998350Z
# User@Host: user[user] @ localhost [] Id: 525243
# Query_time: 0.000001 Lock_time: 0.000000 Rows_sent: 0 Rows_examined: 0
SET timestamp=434231;
# Time: 2022-09-08T02:33:15.9943350Z
# User@Host: user1[user1] @ [127.0.0.1] Id: 132681
# Query_time: 0.000001 Lock_time: 0.000000 Rows_sent: 0 Rows_examined: 0
SET timestamp=965523;

```

First problem, sometimes when you run filebeat it just doesn't read the file, an index is created but it's empty  
The second is that I gave him a template on how to split the file, I expect to see 2 hits in this case, but he glues these messages into one event  
P.s before that, I had a config for logstash with multiline codec and a grok template, and it parsed well

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2022, 5:15pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-error-sending-data-to-logstash/314005/2 "2022-10-06T17:15:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.