# Logstash output not working and not throwing an error

**URL:** <https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [September 28, 2020, 7:59pm UTC](https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259 "2020-09-28T19:59:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [September 28, 2020, 7:59pm UTC](https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259/1 "2020-09-28T19:59:35Z")

</div>

I have winlogbeat and audit beat working fine for logstash output. I cannot get logstash output from packetbeat (7.9.2 and 7.6.1) and no errors show up in the log. Totally stuck on this and is is a simple config. Any Ideas?

packet beat yml file will not send data to logstash and no errors in the log.

```auto
#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

  # Protocol - either `http` (default) or `https`.
  #protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
output:
  logstash:
  # The Logstash hosts
    hosts: ["*.*.*.*:5046"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Processors =====================================

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2020, 1:22am UTC](https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259/2 "2020-09-29T01:22:30Z")

</div>

What do your Packetbeat logs show?

---

<div class="post-metadata">

**Author:** ![frankfoti](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frankfoti/32/26965_2.png) [@frankfoti](https://discuss.elastic.co/u/frankfoti)\
**Post date:** [September 29, 2020, 11:50am UTC](https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259/3 "2020-09-29T11:50:48Z")

</div>

Logs did not show any connection to logstash or attempt.

It turns out the device I was monitoring was not triggering any activity, hence no attempt to send data in. Once I changed to the vpn device I was connected to, data did flow through to logstash.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2020, 11:50am UTC](https://discuss.elastic.co/t/logstash-output-not-working-and-not-throwing-an-error/250259/4 "2020-10-27T11:50:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.