# Help. My filebeat stops working after I installed my wazuh server after 30 minutes

**URL:** <https://discuss.elastic.co/t/help-my-filebeat-stops-working-after-i-installed-my-wazuh-server-after-30-minutes/324536>\
**Category:** Logstash\
**Created:** [February 2, 2023, 12:11pm UTC](https://discuss.elastic.co/t/help-my-filebeat-stops-working-after-i-installed-my-wazuh-server-after-30-minutes/324536 "2023-02-02T12:11:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joshua\_John\_Consulta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshua_john_consulta/32/116687_2.png) [@Joshua\_John\_Consulta](https://discuss.elastic.co/u/Joshua_John_Consulta)\
**Post date:** [February 2, 2023, 12:11pm UTC](https://discuss.elastic.co/t/help-my-filebeat-stops-working-after-i-installed-my-wazuh-server-after-30-minutes/324536/1 "2023-02-02T12:11:19Z")

</div>

Here's the error:  
× filebeat.service - Filebeat sends log files to Logstash or directly to Elasti\>  
Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; preset: ena\>  
Active: failed (Result: exit-code) since Thu 2023-02-02 20:06:47 PST; 4s a\>  
Duration: 43ms  
Docs: [Filebeat: Lightweight Log Analysis & Elasticsearch | Elastic](https://www.elastic.co/products/beats/filebeat)  
Process: 10556 ExecStart=/usr/share/filebeat/bin/filebeat --environment sys\>  
Main PID: 10556 (code=exited, status=2)  
CPU: 52ms

Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: rip 0x7f6c6d29226b  
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: rflags 0x246  
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: cs 0x33  
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: fs 0x0  
Feb 02 20:06:47 VSS-WazuhServer filebeat[10556]: gs 0x0  
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Scheduled restart\>  
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: Stopped Filebeat sends log files to\>  
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Start request rep\>  
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: filebeat.service: Failed with resul\>  
Feb 02 20:06:47 VSS-WazuhServer systemd[1]: Failed to start Filebeat sends log \>  
~

Here's my filebeat.yml:

# Wazuh - Filebeat configuration file

output.elasticsearch:  
hosts: ["127.0.0.1:9200"]  
protocol: https  
username: "admin"  
password: "admin"  
ssl.certificate\_authorities:  
- /etc/filebeat/certs/root-ca.pem  
ssl.certificate: "/etc/filebeat/certs/filebeat.pem"  
ssl.key: "/etc/filebeat/certs/filebeat-key.pem"  
setup.template.json.enabled: true  
setup.template.json.path: '/etc/filebeat/wazuh-template.json'  
setup.template.json.name: 'wazuh'  
setup.ilm.overwrite: true  
setup.ilm.enabled: false

filebeat.modules:

- module: wazuh  
alerts:  
enabled: true  
archives:  
enabled: false

---

<div class="post-metadata">

**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\
**Post date:** [February 12, 2023, 1:20am UTC](https://discuss.elastic.co/t/help-my-filebeat-stops-working-after-i-installed-my-wazuh-server-after-30-minutes/324536/2 "2023-02-12T01:20:01Z")

</div>

Can you try running logstash on the command line to get better insight into what is happening? Sometimes that can help. See [docs](https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html) for more details. Specifically, you increase the logging level.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2023, 1:20am UTC](https://discuss.elastic.co/t/help-my-filebeat-stops-working-after-i-installed-my-wazuh-server-after-30-minutes/324536/3 "2023-03-12T01:20:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.