# How do I check if Logstash is receiving logs from filebeat?

**URL:** <https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652>\
**Category:** Logstash\
**Created:** [January 24, 2019, 7:24pm UTC](https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652 "2019-01-24T19:24:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CG3](https://avatars.discourse-cdn.com/v4/letter/c/aeb1de/32.png) [@CG3](https://discuss.elastic.co/u/CG3)\
**Post date:** [January 24, 2019, 7:24pm UTC](https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652/1 "2019-01-24T19:24:57Z")

</div>

I have an elastic cluster using logstash as the receiver of data. I have several windows machines collecting logs with filebeat and sending to logstash to view in kibana. This is working fine. I now need to add a Linux centos7 server in the collection pool. I've installed filebeat, configured the yml file, and started the service. If I output to a file on the Linux machine, it seems to be collecting the logs correctly.

I still can't see them in Kibana if I remove the file output and add the logstash host in the filebeat config. Yes, I restarted the filebeat service after making the change.

If I telnet from the linux box running filebeat to the logstash node and port, communication looks good.

How can I check logstash to see if it is receiving anything from filebeat?

Thanks.

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [January 25, 2019, 6:03am UTC](https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652/2 "2019-01-25T06:03:40Z")

</div>

> [@CG3](#):
>
> How can I check logstash to see if it is receiving anything from filebeat?

Use TCPdump command to find if the logstash port(5140) is receiving anything in the interface(eth0). The interface and port number may be different in your case.

`tcpdump -Xni eth0 port 5140`

---

<div class="post-metadata">

**Author:** ![CG3](https://avatars.discourse-cdn.com/v4/letter/c/aeb1de/32.png) [@CG3](https://discuss.elastic.co/u/CG3)\
**Post date:** [January 28, 2019, 8:11pm UTC](https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652/3 "2019-01-28T20:11:47Z")

</div>

That is a great tool! It worked. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2019, 8:11pm UTC](https://discuss.elastic.co/t/how-do-i-check-if-logstash-is-receiving-logs-from-filebeat/165652/4 "2019-02-25T20:11:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.