# Filebeat status failed . Please help
**URL:** https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132
**Category:** Beats
**Tags:** filebeat
**Created:** [June 20, 2017, 5:25pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132 "2017-06-20T17:25:03Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@manojkal](https://discuss.elastic.co/u/manojkal)
#### Post date: [June 20, 2017, 5:25pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132/1 "2017-06-20T17:25:03Z")
filebeat.yml
filebeat:
prospectors:
```
- input_type: log
paths:
- /var/log/*.log
```
registry\_file: /var/lib/filebeat/registry
output.elasticsearch:
hosts: ["10.8.20.138:80/es"]
output:
logstash:
hosts:
- ["10.8.20.138:5044"]
Error:
[Host1@CentOS2 filebeat]$ service filebeat status
● filebeat.service - filebeat
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Tue 2017-06-20 10:14:05 PDT; 762ms ago
Docs: [https://www.elastic.co/guide/en/beats/filebeat/current/index.html](https://www.elastic.co/guide/en/beats/filebeat/current/index.html)
Process: 3742 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
Main PID: 3742 (code=exited, status=1/FAILURE)
Jun 20 10:14:04 CentOS2 systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Jun 20 10:14:04 CentOS2 systemd[1]: Unit filebeat.service entered failed state.
Jun 20 10:14:04 CentOS2 systemd[1]: filebeat.service failed.
Jun 20 10:14:05 CentOS2 systemd[1]: filebeat.service holdoff time over, scheduling restart.
Jun 20 10:14:05 CentOS2 systemd[1]: start request repeated too quickly for filebeat.service
Jun 20 10:14:05 CentOS2 systemd[1]: Failed to start filebeat.
Jun 20 10:14:05 CentOS2 systemd[1]: Unit filebeat.service entered failed state.
Jun 20 10:14:05 CentOS2 systemd[1]: filebeat.service failed.
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [June 20, 2017, 6:43pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132/2 "2017-06-20T18:43:34Z")
Could you please check for logs under `/var/log/filebeat`?
---
### Author:  [@manojkal](https://discuss.elastic.co/u/manojkal)
#### Post date: [June 20, 2017, 6:54pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132/3 "2017-06-20T18:54:55Z")
[root@CentOS2 ~]# cd /var/log/filebeat
[root@CentOS2 filebeat]# ls
filebeat filebeat.1 filebeat.2 filebeat.3 filebeat.4 filebeat.5 filebeat.6
I see above
---
### Author:  [@manojkal](https://discuss.elastic.co/u/manojkal)
#### Post date: [June 20, 2017, 6:55pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132/4 "2017-06-20T18:55:30Z")
2017-06-20T10:14:04-07:00 INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017-06-20T10:14:04-07:00 INFO Setup Beat: filebeat; Version: 5.4.1
2017-06-20T10:14:04-07:00 INFO Loading template enabled. Reading template file: /etc/filebeat/filebeat.template.json
2017-06-20T10:14:04-07:00 INFO Loading template enabled for Elasticsearch 2.x. Reading template file: /etc/filebeat/filebeat.template-es2x.json
2017-06-20T10:14:04-07:00 INFO Loading template enabled for Elasticsearch 6.x. Reading template file: /etc/filebeat/filebeat.template-es6x.json
2017-06-20T10:14:04-07:00 INFO Elasticsearch url: [http://10.8.20.138:80/es](http://10.8.20.138:80/es)
2017-06-20T10:14:04-07:00 INFO Activated elasticsearch as output plugin.
2017-06-20T10:14:04-07:00 INFO Max Retries set to: 3
2017-06-20T10:14:04-07:00 ERR failed to initialize logstash plugin as output: can not convert 'object' into 'string' accessing 'output.logstash.hosts.0' (source:'/etc/filebeat/filebeat.yml')
2017-06-20T10:14:04-07:00 CRIT Exiting: error initializing publisher: can not convert 'object' into 'string' accessing 'output.logstash.hosts.0' (source:'/etc/filebeat/filebeat.yml')
~
~
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [June 20, 2017, 7:06pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132/5 "2017-06-20T19:06:47Z")
Ah there it is, didn't see it in the first place. It's a YAML parsing error from your settings, hosts value for output.logstash:
> [@manojkal](#):
>
> hosts:
> - ["10.8.20.138:5044"]
As you are configuring a list it must be either: `hosts: ["10.8.20.138:5044"]` or:
```auto
hosts:
- "10.8.20.138:5044"
```
I think you ended up with a mix of both somehow, please check if it works after correcting that 🙂
---
### Author:  [@manojkal](https://discuss.elastic.co/u/manojkal)
#### Post date: [June 20, 2017, 11:25pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132/6 "2017-06-20T23:25:34Z")
@exekias Thanks a lot. Now i see it as active . But when i see the log file
2017-06-20T13:58:02-07:00 INFO Harvester started for file: /var/log/vmware-vmsvc.2.log
2017-06-20T13:58:02-07:00 ERR Connecting error publishing events (retrying): dial tcp 10.8.20.149:5044: getsockopt: connection refused
2017-06-20T13:58:02-07:00 INFO Connected to Elasticsearch version 1.7.3
2017-06-20T13:58:02-07:00 INFO Trying to load template for client: [http://10.8.20.149:80/es](http://10.8.20.149:80/es)
2017-06-20T13:58:02-07:00 INFO Template already exists and will not be overwritten.
2017-06-20T13:58:02-07:00 WARN Can not index event (status=400): "RemoteTransportException[[es-elasticsearch-masters-1][inet[/10.42.8.185:9300]][indices:admin/create]]; nested: MapperParsingException[mapping [_default_]]; nested: MapperParsingException[No handler for type [keyword] declared on field [referrer]]; "
2017-06-20T13:58:02-07:00 WARN Can not index event (status=400): "RemoteTransportException[[es-elasticsearch-masters-1][inet[/10.42.8.185:9300]][indices:admin/create]]; nested: MapperParsingException[mapping [_default_]]; nested: MapperParsingException[No handler for type [keyword] declared on field [referrer]]; "
2017-06-20T13:58:02-07:00 WARN Can not index event (status=400): "RemoteTransportException[[es-elasticsearch-masters-1][inet[/10.42.8.185:9300]][indices:admin/create]]; nested: MapperParsingException[mapping [_default_]]; nested: MapperParsingException[No handler for type [keyword] declared on field [referrer]]; "
2017-06-20T13:58:02-07:00 WARN Can not index event (status=400): "RemoteTransportException[[es-elasticsearch-masters-1][inet[/10.42.8.185:9300]][indices:admin/create]]; nested: MapperParsingException[mapping [_default_]]; nested: MapperParsingException[No handler for type [keyword] declared on field [referrer]]; "
2017-06-20T13:58:02-07:00 WARN Can not index event (status=400): "RemoteTransportException[[es-elasticsearch-masters-1][inet[/10.42.8.185:9300]][indices:admin/create]]; nested: MapperParsingException[mapping [_default_]]; nested: MapperParsingException[No handler for type [keyword] declared on field [referrer]]; "
2017-06-20T13:58:0
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2017, 11:25pm UTC](https://discuss.elastic.co/t/filebeat-status-failed-please-help/90132/7 "2017-07-18T23:25:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.