# Logstash not showing any data when input is configured with filebeat

**URL:** <https://discuss.elastic.co/t/logstash-not-showing-any-data-when-input-is-configured-with-filebeat/143566>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 8, 2018, 5:10pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-data-when-input-is-configured-with-filebeat/143566 "2018-08-08T17:10:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vijay\_Chander](https://avatars.discourse-cdn.com/v4/letter/v/edb3f5/32.png) [@Vijay\_Chander](https://discuss.elastic.co/u/Vijay_Chander)\
**Post date:** [August 8, 2018, 5:10pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-data-when-input-is-configured-with-filebeat/143566/1 "2018-08-08T17:10:36Z")

</div>

**filebeat.yml file**

> filebeat.prospectors:
> 
> - type: log  
> paths:
> - "/home/ec2-user/logs/sas\_logs/\*.log"  
> output.logstash:  
> hosts: ["localhost:5044"]

**logstash.conf file**

> input {  
> beats {  
> port =\> "5044"  
> }  
> }  
> filter {  
> grok {  
> match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:time\_stamp}\s+%{LOGLEVEL:loglevel}\s+[%{NUMBER:num}]\s+:%{USERNAME:user}\s+-\s+%{GREEDYDATA:msg}" }  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> "[http://localhost:9200](http://localhost:9200)"  
> index =\> "a3\_logs"  
> }  
> stdout {  
> codec =\> rubydebug  
> }  
> }

log format: **2018-07-09T16:20:30,799 INFO [00000006] :sasinst - NOTE: Copyright (c) 2016 by SAS Institute Inc., Cary, NC, USA.**

When I run logstash, it is stuck at Pipeline Started. I'm not able to understand the issue.

Can anyone please help me ??

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [August 8, 2018, 6:02pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-data-when-input-is-configured-with-filebeat/143566/2 "2018-08-08T18:02:24Z")

</div>

Hello @Vijay_Chander, by looking at your filebeat configuration, I believe you have an indentation issue in your configuration and you also need to enable the logstash output.

```auto
filebeat.prospectors:
  - type: log    
    paths:
      - "/home/ec2-user/logs/sas_logs/*.log"
output.logstash:
  enabled: true
  hosts: ["localhost:5044"]

```

Also starting filebeat in debug mode should give us a a better idea is there is others issues, you can do that by running the following command:

```auto
./filebeat -v -e -d "*" -c ./myconfig.yml

```

---

<div class="post-metadata">

**Author:** ![Vijay\_Chander](https://avatars.discourse-cdn.com/v4/letter/v/edb3f5/32.png) [@Vijay\_Chander](https://discuss.elastic.co/u/Vijay_Chander)\
**Post date:** [August 9, 2018, 5:33am UTC](https://discuss.elastic.co/t/logstash-not-showing-any-data-when-input-is-configured-with-filebeat/143566/3 "2018-08-09T05:33:21Z")

</div>

Hi @pierhugues,

I've tried as you suggested but still no luck. Below is my filebeat log

2018-08-09T05:32:11.870Z DEBUG [input] log/input.go:175 input states cleaned up. Before: 5, After: 5, Pending: 0

logstash log

[2018-08-09T05:27:28,029][INFO][logstash.inputs.beats] Beats inputs: Starting input listener {:address=\>"0.0.0.0:5044"}  
[2018-08-09T05:27:28,141][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :thread=\>"#\<Thread:0x1e67cb22 run\>"}  
[2018-08-09T05:27:28,187][INFO][org.logstash.beats.Server] Starting server on port: 5044  
[2018-08-09T05:27:28,322][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>[]}  
[2018-08-09T05:27:28,614][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

Can you please suggest any other way??

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [August 9, 2018, 12:24pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-data-when-input-is-configured-with-filebeat/143566/4 "2018-08-09T12:24:59Z")

</div>

@Vijay_Chander lets concentrate on the Filebeat side, If you want filebeat with the options I've said in my previous comment the log should be a lot bigger. Can you include a more complete log?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2018, 12:33pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-data-when-input-is-configured-with-filebeat/143566/5 "2018-09-06T12:33:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.