# Filebeat StartUp error

**URL:** https://discuss.elastic.co/t/filebeat-startup-error/63477
**Category:** Beats
**Tags:** filebeat
**Created:** [October 20, 2016, 7:23am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477 "2016-10-20T07:23:33Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![manojvenkat](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)
#### Post date: [October 20, 2016, 7:23am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/1 "2016-10-20T07:23:33Z")

</div>

Dear All,

I have installed Filebeat on my application server and have updated filebeat.yml to ship logs to logstash. When I run the command to start the filebeat I get below error. Please advice.

filebeat.service - filebeat  
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)  
Active: failed (Result: start-limit) since Wed 2016-10-19 11:35:31 EDT; 2min 51s ago  
Docs: [https://www.elastic.co/guide/en/beats/filebeat/current/index.html](https://www.elastic.co/guide/en/beats/filebeat/current/index.html)  
Process: 28849 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE)  
Main PID: 28849 (code=exited, status=1/FAILURE)

Oct 19 11:35:31 MYSERVER: filebeat.service: main process exited, code=exited, status=1/FAILURE  
Oct 19 11:35:31 MYSERVER: Unit filebeat.service entered failed state.  
Oct 19 11:35:31 MYSERVER: filebeat.service failed.  
Oct 19 11:35:31 MYSERVER: filebeat.service holdoff time over, scheduling restart.  
Oct 19 11:35:31 MYSERVER: start request repeated too quickly for filebeat.service  
Oct 19 11:35:31 MYSERVER: Failed to start filebeat.  
Oct 19 11:35:31 MYSERVER: Unit filebeat.service entered failed state.  
Oct 19 11:35:31 MYSERVER: filebeat.service failed.

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 20, 2016, 9:43am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/2 "2016-10-20T09:43:37Z")

</div>

most likely your filebeat.yml is wrong. Have you tried to run filebeat in foreground? Can you share your config?

---

<div class="post-metadata">

### Author: ![manojvenkat](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)
#### Post date: [October 20, 2016, 12:50pm UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/3 "2016-10-20T12:50:06Z")

</div>

Thanks Steffens. I am not able to attach the full filebeat.yml file. Please find the attached screenshots. Apart from the properties set in the screenshot all other parameters are commented in yml file ![](https://us1.discourse-cdn.com/elastic/original/2X/8/83700e937f30540de69c1741aa416d54363db1d4.JPG)

 ![](https://us1.discourse-cdn.com/elastic/original/2X/7/725c47bc3c7ef599f06a37023c9ac030d754565d.JPG) ![](https://us1.discourse-cdn.com/elastic/original/2X/e/ea6bcb167c94f2ff120fbb5982caa3f419243722.JPG) ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d3cb1db1609a415b7663af6bf54007abea342ce0.JPG)

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [October 20, 2016, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/4 "2016-10-20T14:45:12Z")

</div>

the screenshot is a little confusing. Did you put logstash correctly into the output section? Why is elasticsearch output still enabled?

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [October 21, 2016, 11:06am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/5 "2016-10-21T11:06:45Z")

</div>

Maybe try `filebeat -configtest -c <path-to-config-file>`

---

<div class="post-metadata">

### Author: ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)
#### Post date: [October 21, 2016, 11:07am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/6 "2016-10-21T11:07:44Z")

</div>

You can simply copy and paste the file in here, and just add ``` at the beginning and the end so that it's properly formatted.

---

<div class="post-metadata">

### Author: ![manojvenkat](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)
#### Post date: [October 21, 2016, 11:25am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/7 "2016-10-21T11:25:09Z")

</div>

Thanks Steffens & Tudor. My bad, It was a typo error for logger level. I corrected it and I could able to start the file beat.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 10, 2016, 7:24am UTC](https://discuss.elastic.co/t/filebeat-startup-error/63477/8 "2016-11-10T07:24:13Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.
