# Logstash cannot consume Filebeat events **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 12, 2015, 6:53pm UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453 "2015-11-12T18:53:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Post date:** [November 12, 2015, 6:53pm UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/1 "2015-11-12T18:53:54Z")
Hello, I have a log file with 4000 lines and I am trying to consume it with filebeat. Using elasticsearch output, it works. I can retreive 4000 documents in my index. But when I use logstash output, my index only have 80 documents ! My logstash config is very simple : I have only a beats input, no filter, and a very simple output to elasticsearch. The only way I have found to make it work is to configure filebeat with a spool\_size of 1 so that logstash has enough time to consume filebeat events. I am on a Windows platform with the latest logstash-input-beats version (0.9.6) Any suggestion about this behaviour ? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [November 12, 2015, 8:30pm UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/2 "2015-11-12T20:30:52Z")
Hi @ogauchard, see the issue below. I think it is the same problem. It is being worked now. [https://github.com/elastic/filebeat/issues/226#issuecomment-156220617](https://github.com/elastic/filebeat/issues/226#issuecomment-156220617) ---
**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Post date:** [November 12, 2015, 8:51pm UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/3 "2015-11-12T20:51:53Z")
Thank you for answering so quickly ! It seems to be the same problem. Just have to wait for the fix ! ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 13, 2015, 7:38am UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/4 "2015-11-13T07:38:53Z")
@ogauchard We found the problem and have a fix ready now. It will be part of RC2. We plan to merge it today, so it will also be part of the next nightly build. It would be great if you could try it out. ---
**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Post date:** [November 13, 2015, 7:51am UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/5 "2015-11-13T07:51:45Z")
Good news ! I'll test it and give you feedback probably on monday. ---
**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Post date:** [November 16, 2015, 11:08am UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/6 "2015-11-16T11:08:49Z")
Well done ! The issue is solved with the nightly build. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [November 16, 2015, 11:56am UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/7 "2015-11-16T11:56:29Z")
@ogauchard That is good news. Thanks for testing and reporting. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/logstash-cannot-consume-filebeat-events/34453/8 "2017-07-05T21:58:12Z")