# Logstash config advise

**URL:** <https://discuss.elastic.co/t/logstash-config-advise/368415>\
**Category:** Logstash\
**Created:** [October 8, 2024, 8:00am UTC](https://discuss.elastic.co/t/logstash-config-advise/368415 "2024-10-08T08:00:09Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![Athen](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@Athen](https://discuss.elastic.co/u/Athen)\
**Post date:** [October 9, 2024, 4:09pm UTC](https://discuss.elastic.co/t/logstash-config-advise/368415/21 "2024-10-09T16:09:08Z")

</div>

Additionally, I am getting this error when I execute the `filebeat setup -e` command, but I don't see this error when I check `/var/log/filebeat`, and I also don't see any logs in Kibana.

added given config to file but still same issue .

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 9, 2024, 4:16pm UTC](https://discuss.elastic.co/t/logstash-config-advise/368415/22 "2024-10-09T16:16:04Z")

</div>

> [@Athen](#):
>
> Additionally, I am getting this error when I execute the `filebeat setup -e` command

You didn't mention this before, but this is expected, `filebeat setup -e` **requires** the output to be Elasticsearch.

If you want to run the `filebeat setup` you need to change your output to be Elasticsearch, after that you can change it back to Logstash, but you cannot run `filebeat setup` with the logstash output configured.

---

<div class="post-metadata">

**Author:** ![Athen](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@Athen](https://discuss.elastic.co/u/Athen)\
**Post date:** [October 9, 2024, 5:48pm UTC](https://discuss.elastic.co/t/logstash-config-advise/368415/23 "2024-10-09T17:48:10Z")

</div>

Thank you very much for your support 🙂

[Previous page](https://discuss.elastic.co/t/logstash-config-advise/368415.md?page=1)