# Filebeat service failing to start
**URL:** https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199
**Category:** Beats
**Tags:** filebeat
**Created:** [October 7, 2020, 1:02am UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199 "2020-10-07T01:02:32Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@aviationfan](https://discuss.elastic.co/u/aviationfan)
#### Post date: [October 7, 2020, 1:02am UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/1 "2020-10-07T01:02:32Z")
Ever since updating to 7.9.2, filebeat has failed to start as a service.
Ubuntu 20.04.1 LTS (Focal Fossa)
```auto
systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Tue 2020-10-06 18:57:45 MDT; 414ms ago
Docs: https://www.elastic.co/products/beats/filebeat
Process: 5939 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, stat>
Main PID: 5939 (code=exited, status=1/FAILURE)
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Start request repeated too quickly.
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
```
Tried re-installing the packages.
Tried removing the service completely.
Have tried to stop and restart the service many times.
I cannot figure out why it is failing.
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [October 7, 2020, 1:22am UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/2 "2020-10-07T01:22:23Z")
Any filebeat logs? There may be error messages there. There's not enough info here to help.
---
### Author:  [@aviationfan](https://discuss.elastic.co/u/aviationfan)
#### Post date: [October 7, 2020, 2:06am UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/3 "2020-10-07T02:06:45Z")
I was thinking the same thing but there are no log entries at all regarding the service error. If I run filebeat manually then the logs show new data but nothing via `systemctl`
---
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [October 7, 2020, 2:26am UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/4 "2020-10-07T02:26:16Z")
Are you able to see any useful logs from `journalctl -xe -u filebeat` ?
---
### Author:  [@aviationfan](https://discuss.elastic.co/u/aviationfan)
#### Post date: [October 7, 2020, 2:39am UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/5 "2020-10-07T02:39:30Z")
Yes that was the command I did not know and it shows the problem
```auto
Oct 06 18:57:45 lubuntu-imac07 filebeat[5939]: Exiting: error loading config file: config file ("/etc/filebeat/filebeat.yml") must be owned by the user identifier (uid=0) or root
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
-- Subject: Unit process exited
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- An ExecStart= process belonging to unit filebeat.service has exited.
--
-- The process' exit code is 'exited' and its exit status is 1.
```
I don't remember changing the permissions to the file but clearly that is the issue.
---
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [October 7, 2020, 5:42am UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/6 "2020-10-07T05:42:06Z")
> [@aviationfan](#):
>
> `("/etc/filebeat/filebeat.yml") must be owned by the user identifier (uid=0) or root`
Refer to documentation below, it stated that:
> You may encounter the following errors if your config file fails these checks:
>
> `Exiting: error loading config file: config file ("{beatname}.yml") must be owned by the beat user (uid=501) or root`
>
> To correct this problem you can use either `chown root {beatname}.yml` or `chown 501 {beatname}.yml` to change the owner of the configuration file.
> **[Config file ownership and permissions | Beats Platform Reference \[8.11\] |...](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-permissions.html)**
---
### Author:  [@aviationfan](https://discuss.elastic.co/u/aviationfan)
#### Post date: [October 7, 2020, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/7 "2020-10-07T13:16:32Z")
The is the weird thing about Linux that confuses me. Why does root have to own the file? If I set the ownership that the prevents my personal user from editing the file. Why can't it be both?
---
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [October 7, 2020, 1:50pm UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/8 "2020-10-07T13:50:16Z")
It explained in the first paragraph of link that I shared
> On systems with POSIX file permissions, all Beats configuration files are subject to ownership and file permission checks. The purpose of these checks is to prevent unauthorized users from providing or modifying configurations that are run by the Beat. The owner of the configuration files must be either `root` or the user who is executing the Beat process. The permissions on each file must disallow writes by anyone other than the owner.
---
### Author:  [@aviationfan](https://discuss.elastic.co/u/aviationfan)
#### Post date: [October 7, 2020, 2:03pm UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/9 "2020-10-07T14:03:27Z")
That makes sense. Thank you for the follow up.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2020, 4:03pm UTC](https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/10 "2020-11-04T16:03:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.