# Logstash not receiving data from beats **URL:** \ **Category:** Logstash\ **Created:** [May 24, 2018, 2:19pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169 "2018-05-24T14:19:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\ **Post date:** [May 24, 2018, 2:19pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/1 "2018-05-24T14:19:41Z")
I have setup one elastic cluster (Elasticsearch + Logstash + Kibana) on windows server. And installed beats(filebeat+winlogbeat) on 3 windows servers. I am able to view all logs from 2 servers, but not from third one. I looked into logstash logs, but cannot find any errors and looks like somewhere in between my logs data got disapered for my third server. How to troubleshoot this issue. Any help is appreciated. Thanks in Advance. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 25, 2018, 6:17am UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/2 "2018-05-25T06:17:42Z")
Look in the logfile of Filebeat/Winlogbeat on the machine whose logs you're not receiving. ---
**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\ **Post date:** [May 25, 2018, 4:54pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/3 "2018-05-25T16:54:30Z")
Both Beat logs not showing any error. Logs only showing that these services are in running state and okay. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 27, 2018, 12:44pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/4 "2018-05-27T12:44:48Z")
You're not necessarily looking for errors. Any clues about what's going on would be useful. Like, are they _attempting_ to send anything? They'll log that too, at least if you increase the logging verbosity. ---
**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\ **Post date:** [May 29, 2018, 3:20pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/5 "2018-05-29T15:20:08Z")
Below errors messages for both filebeat and winlogbeat. The winlogbeat service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. A timeout was reached (30000 milliseconds) while waiting for the winlogbeat service to connect. Any idea how it can be fixed. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 30, 2018, 6:02am UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/6 "2018-05-30T06:02:38Z")
If Winlogbeat can't start I'd expect there to be something in the log. Apart from that I don't have any specific advice. ---
**Author:** ![rohitg](https://avatars.discourse-cdn.com/v4/letter/r/b77776/32.png) [@rohitg](https://discuss.elastic.co/u/rohitg)\ **Post date:** [May 31, 2018, 7:54pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/7 "2018-05-31T19:54:21Z")
Thanks. I re-installed beats and now works fine. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 28, 2018, 8:06pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-data-from-beats/133169/8 "2018-06-28T20:06:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.