# Filebeat: problem with logstash/elasticsearch (version 5.3.0)

**URL:** https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659
**Category:** Beats
**Created:** [March 30, 2017, 11:01am UTC](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659 "2017-03-30T11:01:24Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Gounlaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gounlaf/32/7308_2.png) [@Gounlaf](https://discuss.elastic.co/u/Gounlaf)
#### Post date: [March 30, 2017, 11:01am UTC](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659/1 "2017-03-30T11:01:24Z")

</div>

Hi,

Filebeat service won't start if elasticsearch is not configured.

Below my configuration

```
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  enabled: false
  
#----------------------------- Logstash output --------------------------------
output.logstash:
  enabled: true

  # The Logstash hosts
  hosts: ["elastic.mynetwork.private:5044"]

```

[Following the documentation](https://www.elastic.co/guide/en/beats/filebeat/current/config-filebeat-logstash.html), if logstash is enable, elasticsearch must be disabled.

But I've got this error:

> root@universe:~# cat /var/log/filebeat/filebeat  
> 2017-03-30T12:52:20+02:00 INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]  
> 2017-03-30T12:52:20+02:00 INFO Setup Beat: filebeat; Version: 5.3.0  
> 2017-03-30T12:52:20+02:00 INFO Max Retries set to: 3  
> 2017-03-30T12:52:20+02:00 INFO Activated logstash as output plugin.  
> 2017-03-30T12:52:20+02:00 INFO Publisher name: \*\*\*\*\*\*\*\*\*\*  
> 2017-03-30T12:52:20+02:00 INFO Flush Interval set to: 1s  
> 2017-03-30T12:52:20+02:00 INFO Max Bulk Size set to: 2048  
> 2017-03-30T12:52:20+02:00 INFO filebeat start running.  
> 2017-03-30T12:52:20+02:00 INFO Total non-zero values:  
> 2017-03-30T12:52:20+02:00 INFO Uptime: 6.113606ms  
> 2017-03-30T12:52:20+02:00 INFO filebeat stopped.  
> 2017-03-30T12:52:20+02:00 CRIT Exiting: Filebeat modules configured but the Elasticsearch output is not configured/enabled

It works with other beat (metricbeat at least, configured identically for output)

> root@universe:~# cat /var/log/metricbeat/metricbeat  
> 2017-03-30T12:59:23+02:00 INFO Home path: [/usr/share/metricbeat] Config path: [/etc/metricbeat] Data path: [/var/lib/metricbeat] Logs path: [/var/log/metricbeat]  
> 2017-03-30T12:59:23+02:00 INFO Setup Beat: metricbeat; Version: 5.3.0  
> 2017-03-30T12:59:23+02:00 INFO Max Retries set to: 3  
> 2017-03-30T12:59:23+02:00 INFO Activated logstash as output plugin.  
> 2017-03-30T12:59:23+02:00 INFO Publisher name: \*\*\*\*\*\*\*\*\*\*  
> 2017-03-30T12:59:23+02:00 INFO Flush Interval set to: 1s  
> 2017-03-30T12:59:23+02:00 INFO Max Bulk Size set to: 2048  
> 2017-03-30T12:59:23+02:00 INFO Register [ModuleFactory:[docker, mongodb, mysql, postgresql, system], MetricSetFactory:[apache/status, ceph/cluster\_disk, ceph/cluster\_health, ceph/monitor\_health, ceph/pool\_disk, couchbase/bucket, couchbase/cluster, couchbase/node, docker/container, docker/cpu, docker/diskio, docker/healthcheck, docker/image, docker/info, docker/memory, docker/network, haproxy/info, haproxy/stat, kafka/consumergroup, kafka/partition, mongodb/dbstats, mongodb/status, mysql/status, nginx/stubstatus, php\_fpm/pool, postgresql/activity, postgresql/bgwriter, postgresql/database, prometheus/collector, prometheus/stats, redis/info, redis/keyspace, system/core, system/cpu, system/diskio, system/filesystem, system/fsstat, system/load, system/memory, system/network, system/process, system/socket, zookeeper/mntr]]  
> 2017-03-30T12:59:23+02:00 INFO metricbeat start running.

Thanks

---

<div class="post-metadata">

### Author: ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)
#### Post date: [March 30, 2017, 10:59pm UTC](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659/2 "2017-03-30T22:59:28Z")

</div>

The following message indicates that you have Filebeat modules enabled:

```auto
2017-03-30T12:52:20+02:00 CRIT Exiting: Filebeat modules configured but the Elasticsearch output is not configured/enabled 

```

Filebeat modules do not currently support using the Logstash output because they require ingest node, which is an Elasticsearch feature.

---

<div class="post-metadata">

### Author: ![Gounlaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gounlaf/32/7308_2.png) [@Gounlaf](https://discuss.elastic.co/u/Gounlaf)
#### Post date: [March 31, 2017, 8:10am UTC](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659/3 "2017-03-31T08:10:40Z")

</div>

HI @dedemorton,

Thanks for the clarification. I was thinking that all "beats" support the same output ...

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [March 31, 2017, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659/4 "2017-03-31T12:10:41Z")

</div>

All beats support the same outputs, but when you use filebeat with the modules, elasticsearch is required.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 20, 2017, 11:01am UTC](https://discuss.elastic.co/t/filebeat-problem-with-logstash-elasticsearch-version-5-3-0/80659/5 "2017-04-20T11:01:45Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.
