# Logstash cant receive log from filebeat

**URL:** https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117
**Category:** Beats
**Tags:** filebeat
**Created:** [March 22, 2018, 7:23am UTC](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117 "2018-03-22T07:23:27Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![zxq209](https://avatars.discourse-cdn.com/v4/letter/z/58956e/32.png) [@zxq209](https://discuss.elastic.co/u/zxq209)
#### Post date: [March 22, 2018, 7:23am UTC](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117/1 "2018-03-22T07:23:27Z")

</div>

I'm using filebeat-6.2.3 ,logstash-6.2.2  
filebeat config：

```
filebeat.prospectors:
- type: log
   paths:
    - /path/to/file/log/*.log
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.15.41:5044"]
  enabled: true

```

logstash:

```
input {
        beats{
             port=>5044}
}
output{
        stdout { codec => rubydebug }
}

```

I run the command filebeat ,logstash didn't print the log on stdout.

logstash's console like this:

```
[2018-03-22T14:57:23,959][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2018-03-22T14:57:24,015][INFO][logstash.pipeline] Pipeline started succesfully {:pipeline_id=>"main", :thread=>"#<Thread:0x6df34d4d sleep>"}
[2018-03-22T14:57:24,051][INFO][org.logstash.beats.Server] Starting server on port: 5044
[2018-03-22T14:57:24,078][INFO][logstash.agent] Pipelines running {:count=>1, :pipelines=>["main"]}

```

For testing,I changed the filebeat's config "output.logstash" into output.file ,the test file can be built with log content.

config like this:

```
#output.file:
# path: "/tmp/filebeat"
# filename: filebeat
# enabled: true

```

I wonder how I confirm filebeat has communicated with logstash.  
Why the logstash can't receive the log .  
Thanks a lot!

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [March 22, 2018, 12:10pm UTC](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117/2 "2018-03-22T12:10:19Z")

</div>

> [@zxq209](#):
>
> I wonder how I confirm filebeat has communicated with logstash.

You can run `filebeat test output`.

---

<div class="post-metadata">

### Author: ![zxq209](https://avatars.discourse-cdn.com/v4/letter/z/58956e/32.png) [@zxq209](https://discuss.elastic.co/u/zxq209)
#### Post date: [March 23, 2018, 1:28am UTC](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117/3 "2018-03-23T01:28:44Z")

</div>

Thank you for reply.  
I run the command,there is a WARN:

```
logstash: 192.168.15.41:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.15.41
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK

```

Is there something wrong?  
What do I need to do? My logstash didn't install x-pach,but my elasticsearch did.  
Thanks a lot!

---

<div class="post-metadata">

### Author: ![zxq209](https://avatars.discourse-cdn.com/v4/letter/z/58956e/32.png) [@zxq209](https://discuss.elastic.co/u/zxq209)
#### Post date: [March 23, 2018, 3:03am UTC](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117/4 "2018-03-23T03:03:13Z")

</div>

I know what's the matter with my filebeat.  
For some reasons,at first I run the filebeat and harvested the log into output.file,after that I run the logstash.  
logstash don't receive the old log.  
So,I stop filebeat and delete the registry file,then It works,logstash can receive the logs.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 20, 2018, 3:03am UTC](https://discuss.elastic.co/t/logstash-cant-receive-log-from-filebeat/125117/5 "2018-04-20T03:03:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.