# Filebeat not working

**URL:** <https://discuss.elastic.co/t/filebeat-not-working/274316>\
**Category:** Kibana\
**Created:** [May 28, 2021, 10:10am UTC](https://discuss.elastic.co/t/filebeat-not-working/274316 "2021-05-28T10:10:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Drupad\_Soni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drupad_soni/32/89388_2.png) [@Drupad\_Soni](https://discuss.elastic.co/u/Drupad_Soni)\
**Post date:** [May 28, 2021, 10:10am UTC](https://discuss.elastic.co/t/filebeat-not-working/274316/1 "2021-05-28T10:10:01Z")

</div>

Filebeat not working

● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.  
Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled)  
Active: failed (Result: exit-code) since Fri 2021-05-28 10:06:58 UTC; 6s ago  
Docs: [Filebeat: Lightweight Log Analysis & Elasticsearch | Elastic](https://www.elastic.co/beats/filebeat)  
Process: 7631 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT\_LOG\_OPTS $BEAT\_CONFIG\_OPTS $BEAT\_PATH\_OPTS (cod  
Main PID: 7631 (code=exited, status=1/FAILURE)

May 28 10:06:58 testmispelk systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.  
May 28 10:06:58 testmispelk systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.  
May 28 10:06:58 testmispelk systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..  
May 28 10:06:58 testmispelk systemd[1]: filebeat.service: Start request repeated too quickly.  
May 28 10:06:58 testmispelk systemd[1]: filebeat.service: Failed with result 'exit-code'.  
May 28 10:06:58 testmispelk systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..

---

<div class="post-metadata">

**Author:** ![FALEN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/falen/32/82754_2.png) [@FALEN](https://discuss.elastic.co/u/FALEN)\
**Post date:** [May 28, 2021, 10:31am UTC](https://discuss.elastic.co/t/filebeat-not-working/274316/2 "2021-05-28T10:31:50Z")

</div>

Can you share filebeat.yml config, and add this to your config to see more info in logs

logging.level: info  
logging.to\_files: true  
logging.files:  
path: /var/log/filebeat  
name: filebeat  
keepfiles: 7  
permissions: 0644

---

<div class="post-metadata">

**Author:** ![Drupad\_Soni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drupad_soni/32/89388_2.png) [@Drupad\_Soni](https://discuss.elastic.co/u/Drupad_Soni)\
**Post date:** [May 29, 2021, 7:04pm UTC](https://discuss.elastic.co/t/filebeat-not-working/274316/3 "2021-05-29T19:04:00Z")

</div>

Yes ,

also

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7b7bcda646095f60fba61a19a6b8252e0fb7307.png)

Error: Unexpected token \< in JSON at position 0  
at search\_interceptor\_EnhancedSearchInterceptor.handleSearchError ([http://20.42.94.65:5601/40865/bundles/plugin/data/kibana/data.plugin.js:1:392845](http://20.42.94.65:5601/40865/bundles/plugin/data/kibana/data.plugin.js:1:392845))  
at t.selector ([http://20.42.94.65:5601/40865/bundles/plugin/dataEnhanced/8.0.0/dataEnhanced.plugin.js:2:25709](http://20.42.94.65:5601/40865/bundles/plugin/dataEnhanced/8.0.0/dataEnhanced.plugin.js:2:25709))  
at t.error ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:329:85314](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:329:85314))  
at t.\_error ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:58520](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:58520))  
at t.error ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:58214](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:58214))  
at t.error ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:283:167877](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:283:167877))  
at Object.error ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:329:117577](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:329:117577))  
at t.\_\_tryOrUnsub ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:60242](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:60242))  
at t.error ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:59643](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:59643))  
at t.\_error ([http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:58520](http://20.42.94.65:5601/40865/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:21:58520))

I am facing this error now in kibana

---

<div class="post-metadata">

**Author:** ![Drupad\_Soni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drupad_soni/32/89388_2.png) [@Drupad\_Soni](https://discuss.elastic.co/u/Drupad_Soni)\
**Post date:** [May 29, 2021, 7:07pm UTC](https://discuss.elastic.co/t/filebeat-not-working/274316/4 "2021-05-29T19:07:17Z")

</div>

Now,

I have feeded misp module of filebeat now I am not looking at any feeds of misp in elk

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88bfbd5d7d47f26e3148afb0045ef2186ea91e7a.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c2af625649c6554c19fdf70fd97784a33f340951.png)

I am not really sure where is the lag

---

<div class="post-metadata">

**Author:** ![mohamed\_el\_mannouti](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\
**Post date:** [May 29, 2021, 8:32pm UTC](https://discuss.elastic.co/t/filebeat-not-working/274316/5 "2021-05-29T20:32:24Z")

</div>

what's your outupt elasticsearch or logstash?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2021, 8:32pm UTC](https://discuss.elastic.co/t/filebeat-not-working/274316/6 "2021-06-26T20:32:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.