# Just cannot have filebeat ouput right!

**URL:** <https://discuss.elastic.co/t/just-cannot-have-filebeat-ouput-right/148849>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 17, 2018, 2:49pm UTC](https://discuss.elastic.co/t/just-cannot-have-filebeat-ouput-right/148849 "2018-09-17T14:49:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pastorsx](https://avatars.discourse-cdn.com/v4/letter/p/58956e/32.png) [@pastorsx](https://discuss.elastic.co/u/pastorsx)\
**Post date:** [September 17, 2018, 2:49pm UTC](https://discuss.elastic.co/t/just-cannot-have-filebeat-ouput-right/148849/1 "2018-09-17T14:49:02Z")

</div>

I am trying to use something that should be straightforward:  
beat -\> logstash -\> elasticsearch -\> kibana.  
Few config parameters and I believe it should be fine... but hwres' the catch... I just can't get my beat to forward its info to anyone. In order to get rid of an unknow... I removed logstash from the equation from now so trying to send to ES... but I just can't have it working. I tried different config files from others and I still get errors.. could you please help me out?

I am using the defaults in most things... so I would not expect issues... (When I run the following yaml file... it complains about the following: Exiting: error unpacking config data: more than one namespace configured accessing 'output' (source:'filebeat.yml')" How can that be?.. I have no idea since the file is so simple....  
iAlso, if I use the output.file below... it just doesn't work... I see the output of beat in /var/lib/filebeat which is a default... but how come I cannot override it (again.. that was purely as a testing purpose since my goal is to send to ES or logstash)?

\*\*\*\* command line used to install the kubernetes pod \*\*\*\*\*\*\*\*\*\*\*\*\*  
helm install --name filebeat stable/filebeat -f filebeat\_values.yaml

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* my filebeat\_values.yaml file \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
image:  
repository: [docker.elastic.co/beats/filebeat-oss](http://docker.elastic.co/beats/filebeat-oss)  
tag: 6.4.0  
pullPolicy: IfNotPresent

config:  
filebeat.config:  
prospectors:  
# Mounted `filebeat-prospectors` configmap:  
path: ${path.config}/prospectors.d/_.yml  
# Reload prospectors configs as they change:  
reload.enabled: false  
modules:  
path: ${path.config}/modules.d/_.yml  
# Reload module configs as they change:  
reload.enabled: false

processors:  
- add\_cloud\_metadata:

filebeat.prospectors:  
- type: log  
enabled: true  
paths:  
- /var/log/_.log  
- /var/log/messages  
- /var/log/syslog  
- type: docker  
containers.ids:  
- "_"  
processors:  
- add\_kubernetes\_metadata:  
in\_cluster: true  
- drop\_event:  
when:  
equals:  
kubernetes.container.name: "filebeat"

#output.file:  
#path: "/usr/share/filebeat/data"  
#filename: filebeat  
#rotate\_every\_kb: 10000  
#number\_of\_files: 5  
output.elasticsearch:

#Array of hosts to connect to.  
hosts: ["elastic-elasticsearch-client:9200"]  
#hosts: ["[http://10.32.0.23:9200](http://10.32.0.23:9200)"]

#When a key contains a period, use this format for setting values on the command line:  
#--set config."http.enabled"=true  
http.enabled: false  
http.port: 5066

#Upload index template to Elasticsearch if Logstash output is enabled  
#[https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html)  
#List of Elasticsearch hosts  
indexTemplateLoad: []  
#- elasticsearch:9200

#List of beat plugins  
plugins: []  
#- kinesis.so

#pass custom command. This is equivalent of Entrypoint in docker  
command: []

#pass custom args. This is equivalent of Cmd in docker  
args: []

#A list of additional environment variables  
extraVars: []

#Add additional volumes and mounts, for example to read other log files on the host  
extraVolumes: []  
extraVolumeMounts: []

extraInitContainers: []

resources: {}

priorityClassName: ""

nodeSelector: {}

annotations: {}

tolerations: []  
#- operator: Exists

affinity: {}

rbac:  
#Specifies whether RBAC resources should be created  
create: true

serviceAccount:  
#Specifies whether a ServiceAccount should be created  
create: true  
#The name of the ServiceAccount to use.  
#If not set and create is true, a name is generated using the fullname template  
name:

thanks everyone!

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [September 17, 2018, 4:47pm UTC](https://discuss.elastic.co/t/just-cannot-have-filebeat-ouput-right/148849/2 "2018-09-17T16:47:07Z")

</div>

Hi @pastorsx and welcome 🙂

Does filebeat start? Do you see any other error in the filebeat log?

The `more than one namespace configured accessing 'output' (source:'filebeat.yml')` error seems to indicate that more than one outputs have been configured, but only one is allowed.

Looking at the helm chart for filebeat, I see that it includes a file output, you may need to disable it with:

```auto
output.file:
  enabled: false

```

I hope this helps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2018, 6:54pm UTC](https://discuss.elastic.co/t/just-cannot-have-filebeat-ouput-right/148849/3 "2018-10-15T18:54:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.