# Filebeat on Ubuntu

**URL:** <https://discuss.elastic.co/t/filebeat-on-ubuntu/90636>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 23, 2017, 12:33pm UTC](https://discuss.elastic.co/t/filebeat-on-ubuntu/90636 "2017-06-23T12:33:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pandiyan\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pandiyan_m/32/19404_2.png) [@Pandiyan\_M](https://discuss.elastic.co/u/Pandiyan_M)\
**Post date:** [June 23, 2017, 12:33pm UTC](https://discuss.elastic.co/t/filebeat-on-ubuntu/90636/1 "2017-06-23T12:33:38Z")

</div>

Hi,

I have done ELK 5.4 on Centos and set up filebeats on ubuntu as below

```
wget -qO – https://packages.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add –
# echo ‘deb https://packages.elastic.co/beats/apt stable main’ > /etc/apt/sources.list.d/beats.list 
# apt-get update && apt-get install filebeat

```

After Installation, In filebeat.yml done as below

```
#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/web.log

#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["ELK-Server_IP:5044"]
 # tls:
# certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

```

restarted using `service filebeat restart`

Now went to ELK server and ran

`curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'`

Got error as below

```
[root@elk-centos centos]# curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 0,
    "successful" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : 0.0,
    "hits" : []
  }
}
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [June 23, 2017, 1:04pm UTC](https://discuss.elastic.co/t/filebeat-on-ubuntu/90636/2 "2017-06-23T13:04:48Z")

</div>

Check Filebeat and Logstash logs? Any errors in Filebeat publishing logs to Logstash, or in Logstash? Have you configure Logstash to push event into filebeat index?

---

<div class="post-metadata">

**Author:** ![Pandiyan\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pandiyan_m/32/19404_2.png) [@Pandiyan\_M](https://discuss.elastic.co/u/Pandiyan_M)\
**Post date:** [June 23, 2017, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-on-ubuntu/90636/3 "2017-06-23T13:59:19Z")

</div>

`Have you configure Logstash to push event into filebeat index?`

Let me know steps to push event into filebeat and let me know why

`curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'` is giving error ?

No logs in Filebeat

---

<div class="post-metadata">

**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\
**Post date:** [June 23, 2017, 3:34pm UTC](https://discuss.elastic.co/t/filebeat-on-ubuntu/90636/4 "2017-06-23T15:34:48Z")

</div>

> [@Pandiyan\_M](#):
>
> Let me know steps to push event into filebeat and let me know why

What? Surely you have installed filebeat to push logs to Logstash, and that is it's purpose. I find this question a bit odd.

You are looking at a index directly and it has no information in it, so therefore you need to look at how the logs are getting there.

Tail the /var/log/filebeat on the node and /var/log/logstash/logstash-plain.log on the log stash node for more information.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2017, 3:35pm UTC](https://discuss.elastic.co/t/filebeat-on-ubuntu/90636/5 "2017-07-21T15:35:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.