# Metricbeat can't output to logstash

**URL:** <https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [March 15, 2024, 1:51pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491 "2024-03-15T13:51:29Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![h.d.intodata](https://avatars.discourse-cdn.com/v4/letter/h/c67d28/32.png) [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\
**Post date:** [March 15, 2024, 1:51pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/1 "2024-03-15T13:51:29Z")

</div>

Hi team,

I had my metricbeat configured to elasticsearch, everything was working fine. I now need to include logstash, however, after changing the metricbeat output to logstash with my host, "http://\<ip\_address\>:5044"(enabling the module and commenting out the elastic output), i get the following errors:

1. after using, ./metricbeat -e setup:

```auto
{"log.level":"error","@timestamp":"2024-03-15T13:26:25.118Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1315},"message":"Exiting: index management requested but the Elasticsearch output is not configured/enabled","service.name":"metricbeat","ecs.version":"1.6.0"}
Exiting: index management requested but the Elasticsearch output is not configured/enabled

```

1. after using ./metricbeat -e:

```auto
{"log.level":"error","@timestamp":"2024-03-15T13:26:30.022Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1315},"message":"Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver: ","service.name":"metricbeat","ecs.version":"1.6.0"}
Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver:

```

I have also tried looking into the logstash and metricbeat logs but they don't shed any new light on the problem. If i revert back to the elastic output it works fine. I am very confused why it is not giving any signs that it is connecting to logstash.

my pipeline.conf input is such that:

```auto
 input {
  beats {
    port => 5044
    host => "0.0.0.0"
    codec => "json"
  }
}

```

Any help would be greatly appreciated

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 15, 2024, 6:39pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/2 "2024-03-15T18:39:59Z")

</div>

Hello,

Please share your `metricbeat.yml` so it is possible to know what the configuration is.

---

<div class="post-metadata">

**Author:** ![h.d.intodata](https://avatars.discourse-cdn.com/v4/letter/h/c67d28/32.png) [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\
**Post date:** [March 18, 2024, 8:37am UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/3 "2024-03-18T08:37:09Z")

</div>

Hi @leandrojmp, thank you for your response, certainly here it is:

```auto
metribeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression

setup.dashboards.enabled: true
setup.kibana: 
  host: "http://<ip_address>:5601"

#output.elasticsearch:
  #hosts: ["https://<ip_address>:9200"]
  # ssl.enabled: true
  # ssl.certificate_authorities: "path/to/cert.crt"
  #ssl.verification_mode: none
  # username: "elastic"
  # password: "changeme"

output.logstash:
  enabled: true
  hosts: ["http://<ip_address>:5044"]

```

I have using it with activemq and system modules

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 18, 2024, 1:15pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/4 "2024-03-18T13:15:18Z")

</div>

> [@h.d.intodata](#):
>
> ```auto
> output.logstash:
> enabled: true
> hosts: ["http://<ip_address>:5044"]
> 
> ```

This is wrong, logstash beats input does not use `http`, remove the `http` and configure just the `ip address` and `port`.

> [@h.d.intodata](#):
>
> ```auto
> {"log.level":"error","@timestamp":"2024-03-15T13:26:25.118Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1315},"message":"Exiting: index management requested but the Elasticsearch output is not configured/enabled","service.name":"metricbeat","ecs.version":"1.6.0"}
> Exiting: index management requested but the Elasticsearch output is not configured/enabled
> 
> ```

This error means that you tried to setup metricbeat with `metricbeat -e setup`, but the `elasticsearch` output was disabled, to run `metricbeat -e setup` you need to configure your output to `elasticsearch` or it will not work.

If you didn't run setup before, you need to change your output to elasticsearch, run the setup, and change it back to logstash.

> [@h.d.intodata](#):
>
> ```auto
> {"log.level":"error","@timestamp":"2024-03-15T13:26:30.022Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1315},"message":"Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver: ","service.name":"metricbeat","ecs.version":"1.6.0"}
> Exiting: error connecting to Kibana: fail to get the Kibana version: fail to parse kibana version (): passed version is not semver:
> 
> ```

This error means that you metricbeat cannot get the kibana version for some reason, you have `setup.dashboards.enabled` and `setup.kibana.hosts` configured, so metricbeat will always try to connect to kibana.

You need to check if your metricbeat server can connect to kibana or remove those settings from your configuration file.

---

<div class="post-metadata">

**Author:** ![h.d.intodata](https://avatars.discourse-cdn.com/v4/letter/h/c67d28/32.png) [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\
**Post date:** [March 20, 2024, 8:26am UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/5 "2024-03-20T08:26:16Z")

</div>

In regards to,

> If you didn't run setup before, you need to change your output to elasticsearch, run the setup, and change it back to logstash.

I have ran the setup before with elasticsearch as the output. I got neither of the metricbeat errors above.

Am I right in thinking that i need to do the following steps:

1. revert back to the elasticsearch output run `./metricbeat -e setup`
2. remove `http://` from the logstash output then run `./metricbeat -e setup` again?

Just out of curiosity, is this do with changing the indices or something more uncomplex under the hood?

I now need to change my output to Kafka, would I have have to follow the same steps as listed in this post ( if they are correct) or different steps?

Thank you very much for your help,  
I look forward to your response.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 20, 2024, 11:52am UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/6 "2024-03-20T11:52:46Z")

</div>

> [@h.d.intodata](#):
>
> I have ran the setup before with elasticsearch as the output. I got neither of the metricbeat errors above.

You just need to run setup once, when you configure a new module or when you upgrade the version, there is no need to keep running it.

To run `metricbeat -e setup` the output **needs** to be elasticsearch, it won't work if the output is logtash or kafka.

> [@h.d.intodata](#):
>
> revert back to the elasticsearch output run `./metricbeat -e setup`

Have you added a new module or upgraded it? If no, then there is no need to run sertup again.

> [@h.d.intodata](#):
>
> remove `http://` from the logstash output then run `./metricbeat -e setup` again?

As mentioned, the setup parameter only works if the output is elasticsearch, but if you want to send data to logstash you need to remove the `http` from the output configuration because the logstash output does not use http.

> [@h.d.intodata](#):
>
> Just out of curiosity, is this do with changing the indices or something more uncomplex under the hood?

Not sure if I got, but you run setup to configure the ingest pipelines in Elasticsearch, index templates etc, there is no need to run it multiple times.

---

<div class="post-metadata">

**Author:** ![h.d.intodata](https://avatars.discourse-cdn.com/v4/letter/h/c67d28/32.png) [@h.d.intodata](https://discuss.elastic.co/u/h.d.intodata)\
**Post date:** [March 21, 2024, 2:55pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/7 "2024-03-21T14:55:04Z")

</div>

Thank you for your help everything is sorted now 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2024, 4:55pm UTC](https://discuss.elastic.co/t/metricbeat-cant-output-to-logstash/355491/8 "2024-04-18T16:55:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.