# Filebeat stopped working after an hour after the install

**URL:** <https://discuss.elastic.co/t/filebeat-stopped-working-after-an-hour-after-the-install/324538>\
**Category:** Logstash\
**Created:** [February 2, 2023, 12:16pm UTC](https://discuss.elastic.co/t/filebeat-stopped-working-after-an-hour-after-the-install/324538 "2023-02-02T12:16:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joshua\_John\_Consulta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshua_john_consulta/32/116687_2.png) [@Joshua\_John\_Consulta](https://discuss.elastic.co/u/Joshua_John_Consulta)\
**Post date:** [February 2, 2023, 12:16pm UTC](https://discuss.elastic.co/t/filebeat-stopped-working-after-an-hour-after-the-install/324538/1 "2023-02-02T12:16:57Z")

</div>

Here's the error from the terminal:

```auto
× filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Thu 2023-02-02 20:06:47 PST; 4s ago
   Duration: 43ms
       Docs: https://www.elastic.co/products/beats/filebeat
    Process: 10556 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=2)
   Main PID: 10556 (code=exited, status=2)
        CPU: 52ms

Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: rip 0x7f6c6d29226b
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: rflags 0x246
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: cs 0x33
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: fs 0x0
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: gs 0x0
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Start request repeated too quickly.
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Failed with result 'exit-code'.
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..

```

~  
~  
~

Here's my filebeat.yml:

```auto
# Wazuh - Filebeat configuration file
output.elasticsearch:
  hosts: ["127.0.0.1:9200"]
  protocol: https
  username: "admin"
  password: "admin"
  ssl.certificate_authorities:
    - /etc/filebeat/certs/root-ca.pem
  ssl.certificate: "/etc/filebeat/certs/filebeat.pem"
  ssl.key: "/etc/filebeat/certs/filebeat-key.pem"
setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json'
setup.template.json.name: 'wazuh'
setup.ilm.overwrite: true
setup.ilm.enabled: false

filebeat.modules:
  - module: wazuh
    alerts:
      enabled: true
    archives:
      enabled: false

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 6, 2023, 3:08am UTC](https://discuss.elastic.co/t/filebeat-stopped-working-after-an-hour-after-the-install/324538/2 "2023-02-06T03:08:44Z")

</div>

> [@Joshua\_John\_Consulta](#):
>
> ```auto
> Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
> Feb 02 20:06:47 VSS-WazuhServer systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
> Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Start request repeated too quickly.
> Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Failed with result 'exit-code'.
> Feb 02 20:06:47 VSS-WazuhServer systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
> 
> ```

You need to check your systems logs, there is not enough information on the logs you shared to know what may happened.

Check `/var/log/messages` or `/var/log/syslog` depending on your distro to see why the `systemd` service is failing.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2023, 3:09am UTC](https://discuss.elastic.co/t/filebeat-stopped-working-after-an-hour-after-the-install/324538/3 "2023-03-06T03:09:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.