# Filebeat will not start CentOS 7

**URL:** <https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 9, 2017, 4:50am UTC](https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460 "2017-02-09T04:50:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ben\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\
**Post date:** [February 9, 2017, 4:50am UTC](https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460/1 "2017-02-09T04:50:08Z")

</div>

So I am having a pretty big problem... Filebeat will not start as a service at all. It passes the config test so I know that my filebeat.yml is set up correctly. Here is weird part:

I am running this in a VM, and if I revert to a snapshot to the previous day then Filebeat works. Of course that really is no help because restarting a machine is pretty necessary.

![](https://us1.discourse-cdn.com/elastic/original/2X/8/8289c00be8e4edb89cb7d268f287021cd98a3c5c.JPG)

As you can see above, logstash is running fine. Packetbeat is also running perfectly fine on this same box, it is just filebeat. I have tried with packetbeat running and not running with the same results.

Here is the log file from Filebeat

![](https://us1.discourse-cdn.com/elastic/original/2X/c/caba4048a8f3d583a18a68b217c558846730f4be.JPG)

I don't know what else to try... the only output that I get when I run with '-d' for debug mode is this:

```
Exiting: Could not start registrar: Error loading state: Error decoding states: EOF

```

Like I said reboot doesn't do anything and the rest of this server is running fine.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 9, 2017, 5:11am UTC](https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460/2 "2017-02-09T05:11:03Z")

</div>

Did you have Filebeat working properly at one point? Did you experience any kind of power failure or hard shutdown?

You should be able to remove the registry file at /var/lib/filebeat/registry and Filebeat should start.

It sounds like you might be experiencing this issue: [https://github.com/elastic/beats/issues/3537](https://github.com/elastic/beats/issues/3537) Can you please leave a comment on the Github issue saying you are also affected by it if you think it's the same issue.

---

<div class="post-metadata">

**Author:** ![Ben\_Hoffman](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\
**Post date:** [February 9, 2017, 5:20am UTC](https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460/3 "2017-02-09T05:20:50Z")

</div>

Thank you very much! I deleted the registry file, and did the follow commands and now it works.

```
rm -r registry
systemctl reset-failed filebeat
systemctl start filebeat

```

I commented on the GitHub as well, thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2017, 5:21am UTC](https://discuss.elastic.co/t/filebeat-will-not-start-centos-7/74460/4 "2017-03-09T05:21:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.