Filebeat StartUp error


(Manoj) #1

Dear All,

I have installed Filebeat on my application server and have updated filebeat.yml to ship logs to logstash. When I run the command to start the filebeat I get below error. Please advice.

filebeat.service - filebeat
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Wed 2016-10-19 11:35:31 EDT; 2min 51s ago
Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
Process: 28849 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE)
Main PID: 28849 (code=exited, status=1/FAILURE)

Oct 19 11:35:31 MYSERVER: filebeat.service: main process exited, code=exited, status=1/FAILURE
Oct 19 11:35:31 MYSERVER: Unit filebeat.service entered failed state.
Oct 19 11:35:31 MYSERVER: filebeat.service failed.
Oct 19 11:35:31 MYSERVER: filebeat.service holdoff time over, scheduling restart.
Oct 19 11:35:31 MYSERVER: start request repeated too quickly for filebeat.service
Oct 19 11:35:31 MYSERVER: Failed to start filebeat.
Oct 19 11:35:31 MYSERVER: Unit filebeat.service entered failed state.
Oct 19 11:35:31 MYSERVER: filebeat.service failed.


(Steffen Siering) #2

most likely your filebeat.yml is wrong. Have you tried to run filebeat in foreground? Can you share your config?


(Manoj) #3

Thanks Steffens. I am not able to attach the full filebeat.yml file. Please find the attached screenshots. Apart from the properties set in the screenshot all other parameters are commented in yml file


(Steffen Siering) #4

the screenshot is a little confusing. Did you put logstash correctly into the output section? Why is elasticsearch output still enabled?


(Tudor Golubenco) #5

Maybe try filebeat -configtest -c <path-to-config-file>


(Tudor Golubenco) #6

You can simply copy and paste the file in here, and just add ``` at the beginning and the end so that it's properly formatted.


(Manoj) #7

Thanks Steffens & Tudor. My bad, It was a typo error for logger level. I corrected it and I could able to start the file beat.


(system) #8

This topic was automatically closed after 21 days. New replies are no longer allowed.