Filebeat StartUp error

Elastic Stack Beats
1

Dear All,

I have installed Filebeat on my application server and have updated filebeat.yml to ship logs to logstash. When I run the command to start the filebeat I get below error. Please advice.

filebeat.service - filebeat
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Wed 2016-10-19 11:35:31 EDT; 2min 51s ago
Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
Process: 28849 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE)
Main PID: 28849 (code=exited, status=1/FAILURE)

Oct 19 11:35:31 MYSERVER: filebeat.service: main process exited, code=exited, status=1/FAILURE
Oct 19 11:35:31 MYSERVER: Unit filebeat.service entered failed state.
Oct 19 11:35:31 MYSERVER: filebeat.service failed.
Oct 19 11:35:31 MYSERVER: filebeat.service holdoff time over, scheduling restart.
Oct 19 11:35:31 MYSERVER: start request repeated too quickly for filebeat.service
Oct 19 11:35:31 MYSERVER: Failed to start filebeat.
Oct 19 11:35:31 MYSERVER: Unit filebeat.service entered failed state.
Oct 19 11:35:31 MYSERVER: filebeat.service failed.

2

most likely your filebeat.yml is wrong. Have you tried to run filebeat in foreground? Can you share your config?

3

Thanks Steffens. I am not able to attach the full filebeat.yml file. Please find the attached screenshots. Apart from the properties set in the screenshot all other parameters are commented in yml file

Filebeat_1.JPG669×570 67.2 KB
Filebeat_2.JPG669×607 80.4 KB
Filebeat_4.JPG623×528 52.8 KB

4

the screenshot is a little confusing. Did you put logstash correctly into the output section? Why is elasticsearch output still enabled?

5

Maybe try filebeat -configtest -c <path-to-config-file>

6

You can simply copy and paste the file in here, and just add ``` at the beginning and the end so that it's properly formatted.

7

Thanks Steffens & Tudor. My bad, It was a typo error for logger level. I corrected it and I could able to start the file beat.

8

This topic was automatically closed after 21 days. New replies are no longer allowed.