# Logstash doesn't receive packetbeat logs **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [May 3, 2019, 2:08pm UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-packetbeat-logs/179548 "2019-05-03T14:08:12Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Robin020](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Post date:** [May 3, 2019, 2:08pm UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-packetbeat-logs/179548/1 "2019-05-03T14:08:12Z")
Hello, I have the following set up: - server1 is running packetbeat. In packetbeat.yml i have configure output to my logstash node. - server2 is running logstash and elasticsearch. There is were I want to send all my data. I use the standard beats pipeline config that's listen on 5044. When I do curl [http://www.elastic.co/](http://www.elastic.co/) on server one, I should see this on server 2. I check this with curl -XGET '[http://localhost:9200/packetbeat-\*/\_search?pretty](http://localhost:9200/packetbeat-*/_search?pretty)' but see anything .... Do I miss something? How can I troubleshoot this? Robin ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [May 3, 2019, 3:11pm UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-packetbeat-logs/179548/2 "2019-05-03T15:11:29Z")
Can you repeat the test running Packetbeat with debug enabled (`-d '*'`) and share the output ? ---
**Author:** ![Robin020](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Post date:** [May 3, 2019, 3:47pm UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-packetbeat-logs/179548/3 "2019-05-03T15:47:38Z")
With commando: curl -XGET '[http://localhost:9200/packetbeat-](http://localhost:9200/packetbeat-)_/\_search?pretty' -d '_' I get this output: "error" : "Content-Type header [application/x-www-form-urlencoded] is not supported", "status" : 406 In the meantime, I see that the service failed. Here are the logs from the services: apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Service hold-off time over, scheduling restart. apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Scheduled restart job, restart counter is at 5. apr 05 00:58:09 server01 systemd[1]: Stopped Packetbeat analyzes network traffic and sends the data to Elasticsearch.. apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Start request repeated too quickly. apr 05 00:58:09 server01 systemd[1]: packetbeat.service: Failed with result 'exit-code'. apr 05 00:58:09 server01 systemd[1]: Failed to start Packetbeat analyzes network traffic and sends the data to Elasticsearch.. -- Reboot -- apr 05 01:36:12 server01 systemd[1]: Started Packetbeat analyzes network traffic and sends the data to Elasticsearch.. apr 05 01:36:14 server01 packetbeat[759]: Exiting: error loading config file: config file ("/etc/packetbeat/packetbeat.yml") can only be writable by the owner but the permission apr 05 01:36:14 server01 systemd[1]: packetbeat.service: Main process exited, code=exited, status=1/FAILURE apr 05 01:36:14 server01 systemd[1]: packetbeat.service: Failed with result 'exit-code'. apr 05 01:36:15 server01 systemd[1]: packetbeat.service: Service hold-off time over, scheduling restart. It's staying in this loop. Hope you know something ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2019, 3:47pm UTC](https://discuss.elastic.co/t/logstash-doesnt-receive-packetbeat-logs/179548/4 "2019-05-31T15:47:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.