# Logstash doesn't receive Metricbeat data

**URL:** <https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [May 10, 2017, 6:42am UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196 "2017-05-10T06:42:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumitbiswas](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\
**Post date:** [May 10, 2017, 6:42am UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196/1 "2017-05-10T06:42:56Z")

</div>

Hi,

I am trying to make Metricbeat (running in remote server) to send data to Logstash and from there to Elasticsearch.

I already have Filebeat (running in same remote server) to send data to same Logstash and then to Elasticsearch. This is working well.

Since I am sending data through Logstash, I ran below command

> curl -H 'Content-Type: application/json' -XPUT '[http://localhost:9200/\_template/metricbeat](http://localhost:9200/_template/metricbeat)' -d@metricbeat.template.json

metricbeat.yml looks like below. I have entered same ip address and port for Logstash as mentioned in filebeat.yml file.

> metricbeat.modules:  
> #------------------------------- System Module -------------------------------
> 
> - module: system  
> metricsets:
> # CPU stats
> 
> - cpu  
> ...  
> output.logstash:  
> hosts: ["ip:5044"]

I have commented elasticsearch module in above file.

My Logstash confile looks like below

> input {  
> beats {  
> port =\> 5044  
> }  
> }  
> filter {  
> grok {  
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{WORD:ProcessName} %{INT:Latency}" }  
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{WORD:SubProcessName} %{INT:Count}" }  
> }

> mutate {  
> convert =\> { "Latency" =\> "integer" }  
> }

> mutate {  
> convert =\> { "Count" =\> "integer" }  
> }

> date {  
> match =\> ["timestamp" , "MMM dd HH:mm:ss.SSSSSS"]  
> }

> if "\_grokparsefailure" in [tags] {  
> drop { }  
> }

> mutate {  
> remove\_field =\> ["ProcessName", "SubProcessName"]  
> }

> }

> output {  
> elasticsearch {  
> hosts =\> ["[http://localhost:9200](http://localhost:9200)"]  
> index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
> document\_type =\> "%{[@metadata][type]}"  
> }  
> }

When I start all processes, I see index like filebeat-2017.02.07, but nothing appears for Metricbeat.

I must be doing something wrong but don't know what. Can you please help me to resolve it?

---

<div class="post-metadata">

**Author:** ![sumitbiswas](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\
**Post date:** [May 10, 2017, 7:16am UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196/2 "2017-05-10T07:16:21Z")

</div>

I think the problem is with loading template. I.e.

> curl -H 'Content-Type: application/json' -XPUT '[http://localhost:9200/\_template/metricbeat](http://localhost:9200/_template/metricbeat)' -d@metricbeat.template.json

I copied metricbeat.template.json from Remote Server where I placed Metricbeat to Logstash server. Then I ran above command in Logstash server from the directory I copied to. The acknowledgement was true as its result output.

Is this the problem? Not able to figure it out.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 10, 2017, 2:34pm UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196/3 "2017-05-10T14:34:54Z")

</div>

I wonder if it is something to do with the LS filters. I'm assuming those are only for Filebeat data, so could you try putting a conditional around all that logic so that it only applies to the Filebeat data.

```auto
filters {
  if [@metadata][beat] == "filebeat" {
    // Filebeat specific logic.
  }
}

```

---

<div class="post-metadata">

**Author:** ![sumitbiswas](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\
**Post date:** [May 11, 2017, 5:48am UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196/4 "2017-05-11T05:48:49Z")

</div>

Thanks Andrew. You made my day. That was right. So I guess this is what was happening. The event from Metricbeat was either dropped or removed. So now after the if condition, Metricbeat event goes separately and doesn't get filtered with Filebeat conditions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2017, 5:53am UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-metricbeat-data/85196/5 "2017-06-08T05:53:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.