# Filebeat running error

**URL:** https://discuss.elastic.co/t/filebeat-running-error/107334
**Category:** Beats
**Tags:** filebeat
**Created:** [November 13, 2017, 7:14am UTC](https://discuss.elastic.co/t/filebeat-running-error/107334 "2017-11-13T07:14:41Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![vaddanam](https://avatars.discourse-cdn.com/v4/letter/v/7bcc69/32.png) [@vaddanam](https://discuss.elastic.co/u/vaddanam)
#### Post date: [November 13, 2017, 7:14am UTC](https://discuss.elastic.co/t/filebeat-running-error/107334/1 "2017-11-13T07:14:42Z")

</div>

Hi Team,  
file beat is not starting as a service even after executing the command. It's showing the below status :

sudo systemctl status filebeat.service  
[sudo] password for elkservice:  
â filebeat.service - filebeat  
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)  
Active: failed (Result: start-limit) since Mon 2017-11-13 06:40:04 GMT; 32min ago  
Docs: [https://www.elastic.co/guide/en/beats/filebeat/current/index.html](https://www.elastic.co/guide/en/beats/filebeat/current/index.html)  
Process: 31650 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)  
Main PID: 31650 (code=exited, status=1/FAILURE)

Nov 13 06:40:04 hofpreb2b1 systemd[1]: Unit filebeat.service entered failed state.  
Nov 13 06:40:04 hofpreb2b1 systemd[1]: filebeat.service failed.  
Nov 13 06:40:04 hofpreb2b1 systemd[1]: filebeat.service holdoff time over, scheduling restart.  
Nov 13 06:40:04 hofpreb2b1 systemd[1]: start request repeated too quickly for filebeat.service  
Nov 13 06:40:04 hofpreb2b1 systemd[1]: Failed to start filebeat.  
Nov 13 06:40:04 hofpreb2b1 systemd[1]: Unit filebeat.service entered failed state.  
Nov 13 06:40:04 hofpreb2b1 systemd[1]: filebeat.service failed.

Earlier the software was installed using rpm and it used to work without any issues with the root user. Now a new user is created with sudo permissions and we are trying to start the service. It's not starting.

Can some one help me.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [November 13, 2017, 6:15pm UTC](https://discuss.elastic.co/t/filebeat-running-error/107334/2 "2017-11-13T18:15:50Z")

</div>

Please format logs, terminal output and configs using the `</>`-button.

You also have some filebeat logs?

Have you tried to start filebeat in the terminal, without systemd?

---

<div class="post-metadata">

### Author: ![vaddanam](https://avatars.discourse-cdn.com/v4/letter/v/7bcc69/32.png) [@vaddanam](https://discuss.elastic.co/u/vaddanam)
#### Post date: [November 14, 2017, 7:50am UTC](https://discuss.elastic.co/t/filebeat-running-error/107334/3 "2017-11-14T07:50:09Z")

</div>

Hi Steffens,  
Thanks for the reply. The issue is lack of permissions. When tried with the permissions the service is running as root instead of application user and the logs are created with option -rw-------. Not able to see teh logs as the user is not root user.

Manually i tried to run the service with the below command :  
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /usr/share/filebeat/bin/data -path.logs /var/log/filebeat but this is not running continuously. When i closed teh terminal it's exiting.

Can you help me with it

Regards  
Srinivas V

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2017, 7:50am UTC](https://discuss.elastic.co/t/filebeat-running-error/107334/4 "2017-12-12T07:50:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
