# Help newcomer: Payloads received but no output

**URL:** <https://discuss.elastic.co/t/help-newcomer-payloads-received-but-no-output/108178>\
**Category:** Logstash\
**Created:** [November 17, 2017, 5:36pm UTC](https://discuss.elastic.co/t/help-newcomer-payloads-received-but-no-output/108178 "2017-11-17T17:36:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tehowe](https://avatars.discourse-cdn.com/v4/letter/t/a3d4f5/32.png) [@tehowe](https://discuss.elastic.co/u/tehowe)\
**Post date:** [November 17, 2017, 5:36pm UTC](https://discuss.elastic.co/t/help-newcomer-payloads-received-but-no-output/108178/1 "2017-11-17T17:36:09Z")

</div>

Hello!

I'm trying to get a single filebeat to logstash test connection up and running in my environment and have been for some time. I'd been struggling with what I thought was an encryption problem for a while on 5.6 until it finally occurred to me to remove the encryption lines from the filebeat and logstash configurations, try it in the clear, and discovered I was _still_ getting connection resets in the filebeat logs. No data was being sent. I upped the timeout in logstash and the problem continued.

Next, a recent discussion on IRC led me to update all the things to 6.0.0 in order to make use of the `filebeat test output` feature and under 6.0.0 it appears the connection is now being made... which is confusing... but I'm not seeing any output regardless of whether I use the stdout, file, or elasticsearch output modules. The way forward is probably to a) take a deep breath, b) get this working unencrypted, then if I still have issues with encryption I'll open another topic. So hopefully someone can help!

Here are the relevant clauses of the configuration files:

/etc/filebeat/filebeat.yml

```auto
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.1.20:5044"]

# ssl.enabled: true
# ssl.supported_protocols: [TLSv1.2]
  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
# ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash.crt"]

  # Certificate for SSL client authentication
# ssl.certificate: "/etc/pki/tls/certs/logstash.crt"

  # Client Certificate Key
# ssl.key: "/etc/pki/tls/client/logstash.key"

```

/etc/logstash/conf.d/logstash.conf

```auto
input {
   beats {
      port => 5044
      codec => "json_lines"
      client_inactivity_timeout => 1200
    }
}
output {
   stdout {}
}

```

I've also tried, in place of stdout,

```auto
output {
 file {
   path => "/var/log/logstash/output.txt"
   codec => line { format => "custom format: %{message}"}
 }
}

```

As well as

```auto
output {
  elasticsearch {
    hosts => ["192.168.1.30:9200", "192.168.1.31:9200", "192.168.1.32:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

But regardless of whether I run logstash as a daemon or from the command line with

```auto
/usr/share/logstash/bin/logstash --debug --path.settings /etc/logstash

```

I see neither output to the console, file on disk, nor indices in my ES cluster being generated.

I do see this in the logs, though, which suggests the data is getting to logstash

```auto
[2017-11-17T16:33:07,572][DEBUG][logstash.pipeline] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x5ea02d32@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290 sleep>"}
[2017-11-17T16:33:12,439][DEBUG][org.logstash.beats.BeatsHandler] [local: 192.168.1.20:5044, remote: 192.168.1.10:49582] Received a new payload
[2017-11-17T16:33:12,439][DEBUG][org.logstash.beats.BeatsHandler] [local: 192.168.1.20:5044, remote: 192.168.1.10:49582] Sending a new message for the listener, sequence: 1
[2017-11-17T16:33:12,573][DEBUG][logstash.pipeline] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x5ea02d32@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:290 sleep>"}

```

What is going on???

---

<div class="post-metadata">

**Author:** ![tehowe](https://avatars.discourse-cdn.com/v4/letter/t/a3d4f5/32.png) [@tehowe](https://discuss.elastic.co/u/tehowe)\
**Post date:** [November 17, 2017, 9:57pm UTC](https://discuss.elastic.co/t/help-newcomer-payloads-received-but-no-output/108178/2 "2017-11-17T21:57:43Z")

</div>

I removed this line in the input clause

codec =\> "json\_lines"

Apparently filebeat doesn't ship in json

On to backfilling the crypto!

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 18, 2017, 6:47am UTC](https://discuss.elastic.co/t/help-newcomer-payloads-received-but-no-output/108178/3 "2017-11-18T06:47:06Z")

</div>

The beats plugin decides the message, so the codec will be applied to the message field as usual.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2017, 6:47am UTC](https://discuss.elastic.co/t/help-newcomer-payloads-received-but-no-output/108178/4 "2017-12-16T06:47:19Z")

</div>

Closed on December 16, 2017, 6:47am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.