# How to ship logs from filebeat to elasticsearch

**URL:** <https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039>\
**Category:** Elasticsearch\
**Created:** [June 23, 2022, 4:04pm UTC](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039 "2022-06-23T16:04:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gisellecarballo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gisellecarballo/32/112755_2.png) [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\
**Post date:** [June 23, 2022, 4:04pm UTC](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039/1 "2022-06-23T16:04:26Z")

</div>

Hi Everyone,  
I am trying to form a setup where my cisco devices syslog to be sent to filebeat and then filebeat will send it to elasticsearch so that it can be viewed on kibana.

Problem: Filebeat error is The requested URL could not be retrieved. 503 service unavailable

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a6f6113ce9bb7c7b101ac744346507e21316c5ce.png)

Below is my current configuration:

```auto
**filebeat server: 172.30.169.51**
--
filebeat.inputs
- type: syslog
enabled: false
paths:
    - /var/log/*.log

- type: filestream
  enabled: false
    - /var/log/*.log

filebeat.config.modules:
  enabled: false
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "https://172.30.169.50:5000"
  ssl.verification_mode: "none"
  username: "elastic"
  password: "m4gN3s!@.123"

output.elasticsearch:
   hosts: ["172.30.169.50:9200"]
   ssl.verification_mode: "none"
   username: "elastic"
   password: "m4gN3s!@.123"

indices:
- index: "sbx-%{+yyyy.MM.dd}"
  when.regexp:
   hostname: "^SBX-SS01.*"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

setup.ilm.overwrite: true
---
**Troubleshooting:**
 **Command was done under filebeat server:**
root@filelogs01-ph:~# nc -zv -w5 172.30.169.50 9200
Connection to 172.30.169.50 9200 port [tcp/*] succeeded!
~
root@filelogs01-ph:~# curl -u elastic "http://172.30.169.50:9200/_cat/indices"
Enter host password for user 'elastic':
green open .security-7 SGZB30AyR62Tldu36eAOsA 1 0 60 0 276.8kb 276.8kb
green open .apm-custom-link rJpdqcMtQryvdDgOK9yFNA 1 0 0 0 226b 226b
green open .apm-agent-configuration 0fZldFi3R9y3Jfd_lgMMUw 1 0 0 0 226b 226b
green open .async-search Uc2q4OlRTPK12eRimZJnbw 1 0 12 4 105.7kb 105.7kb
green open .kibana_task_manager_7.17.4_001 mYgoqTxeRkyNClEpWyaCBQ 1 0 18 3367 2.5mb 2.5mb
green open .fleet-policies-7 VqPP2BZMQhurIqcsv8uaCw 1 0 2 0 11.3kb 11.3kb
green open .kibana_7.17.4_001 5glUOGE8TnG4GNoFYu0OZA 1 0 576 54 2.4mb 2.4mb
green open .tasks 7hTFpMWaS5CSEHQ_Asrn4Q 1 0 22 0 66.5kb 66.5kb
~
root@filelogs01-ph:~# curl -u elastic "http://172.30.169.50:9200/_cat/health?v&pretty"
Enter host password for user 'elastic':
epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1656028882 00:01:22 elasticsearch green 1 1 13 13 0 0 0 0 - 100.0%

![image|690x44](upload://oMZQjsMD75aYfQrRtJal144Vnx3.png)

![image|690x116](upload://dqWCLLjhmi9gmdLobrtNkmVbI4C.png)

Thank you so much in advance
```

---

<div class="post-metadata">

**Author:** ![gisellecarballo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gisellecarballo/32/112755_2.png) [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\
**Post date:** [June 23, 2022, 8:14pm UTC](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039/2 "2022-06-23T20:14:55Z")

</div>

Hi Team,

Please ignore this.  
This is now solved

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 24, 2022, 12:10am UTC](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039/3 "2022-06-24T00:10:26Z")

</div>

In future please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2022, 12:11am UTC](https://discuss.elastic.co/t/how-to-ship-logs-from-filebeat-to-elasticsearch/308039/4 "2022-07-22T00:11:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.