# Metricbeat does not start service

**URL:** <https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [May 5, 2020, 12:15am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059 "2020-05-05T00:15:01Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 12:15am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/1 "2020-05-05T00:15:02Z")

</div>

Hi guys

I've been trying to implement kibana in my aws. i have 4 instances in total

1. elasticsearch  
2.logstash
2. kibana,filebeat and metricbeat
3. app instance (nginx)  
i would like, from kibana, be able to display meatricbeat of my app instance.  
ive been told to enable http module metricbeat and pass in host the app ip, which i did, and after that, i cannot start metricbeat service anymore. any suggestion please?  
this is the error.

```auto
● metricbeat.service - Metricbeat is a lightweight shipper for metrics.
   Loaded: loaded (/lib/systemd/system/metricbeat.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Tue 2020-05-05 00:10:44 UTC; 4s ago
     Docs: https://www.elastic.co/products/beats/metricbeat
  Process: 1757 ExecStart=/usr/share/metricbeat/bin/metricbeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=1/FAILURE)
 Main PID: 1757 (code=exited, status=1/FAILURE)

May 05 00:10:44 ip-10-0-105-101 systemd[1]: metricbeat.service: Main process exited, code=exited, status=1/FAILURE
May 05 00:10:44 ip-10-0-105-101 systemd[1]: metricbeat.service: Failed with result 'exit-code'.
May 05 00:10:44 ip-10-0-105-101 systemd[1]: metricbeat.service: Service hold-off time over, scheduling restart.
May 05 00:10:44 ip-10-0-105-101 systemd[1]: metricbeat.service: Scheduled restart job, restart counter is at 5.
May 05 00:10:44 ip-10-0-105-101 systemd[1]: Stopped Metricbeat is a lightweight shipper for metrics..
May 05 00:10:44 ip-10-0-105-101 systemd[1]: metricbeat.service: Start request repeated too quickly.
May 05 00:10:44 ip-10-0-105-101 systemd[1]: metricbeat.service: Failed with result 'exit-code'.
May 05 00:10:44 ip-10-0-105-101 systemd[1]: Failed to start Metricbeat is a lightweight shipper for metrics..

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 12:19am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/2 "2020-05-05T00:19:04Z")

</div>

Can you check `/var/log/metricbeat/metricbeat.log` and post that?

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 12:21am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/3 "2020-05-05T00:21:57Z")

</div>

i got 2 logs:

metricbeat:

```auto
2020-05-04T23:52:02.047Z INFO instance/beat.go:622 Home path: [/usr/share/metricbeat] Config path: [/etc/metricbeat] Data path: [/var/lib/metricbeat] Logs path: [/var/log/metricbeat]
2020-05-04T23:52:02.048Z INFO instance/beat.go:630 Beat ID: 782dce8b-8418-486a-9254-567fc5e6dc36

```

metricbeat.1

```auto
2020-05-04T23:52:01.887Z INFO instance/beat.go:622 Home path: [/usr/share/metricbeat] Config path: [/etc/metricbeat] Data path: [/var/lib/metricbeat] Logs path: [/var/log/metricbeat]
2020-05-04T23:52:01.896Z INFO instance/beat.go:630 Beat ID: 782dce8b-8418-486a-9254-567fc5e6dc36

```

which are the same

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 12:24am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/4 "2020-05-05T00:24:22Z")

</div>

Thanks, can you try running metricbeat manually and seeing what the output is?

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 12:27am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/5 "2020-05-05T00:27:09Z")

</div>

sorry just to make sure i understand.

do you mean not provisioning my instance with metricbeat, but install it normally after the instance is app and running right?

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 12:41am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/6 "2020-05-05T00:41:08Z")

</div>

if i print the journalctl i got this:

```auto
May 05 00:38:36 ip-10-0-105-101 systemd[1]: Failed to start Metricbeat is a lightweight shipper for metrics..
-- Subject: Unit metricbeat.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
-- 
-- Unit metricbeat.service has failed.
-- 
-- The result is RESULT.
May 05 00:38:41 ip-10-0-105-101 sudo[1837]: ubuntu : TTY=pts/0 ; PWD=/home/ubuntu ; USER=root ; COMMAND=/bin/systemctl status metricbeat
May 05 00:38:41 ip-10-0-105-101 sudo[1837]: pam_unix(sudo:session): session opened for user root by ubuntu(uid=0)
May 05 00:38:41 ip-10-0-105-101 sudo[1837]: pam_unix(sudo:session): session closed for user root
May 05 00:38:42 ip-10-0-105-101 sudo[1840]: ubuntu : TTY=pts/0 ; PWD=/home/ubuntu ; USER=root ; COMMAND=/bin/systemctl start metricbeat
May 05 00:38:42 ip-10-0-105-101 sudo[1840]: pam_unix(sudo:session): session opened for user root by ubuntu(uid=0)
May 05 00:38:42 ip-10-0-105-101 systemd[1]: metricbeat.service: Start request repeated too quickly.
May 05 00:38:42 ip-10-0-105-101 systemd[1]: metricbeat.service: Failed with result 'exit-code'.
May 05 00:38:42 ip-10-0-105-101 systemd[1]: Failed to start Metricbeat is a lightweight shipper for metrics..
-- Subject: Unit metricbeat.service has failed
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
-- 
-- Unit metricbeat.service has failed.
-- 
-- The result is RESULT.
May 05 00:38:42 ip-10-0-105-101 sudo[1840]: pam_unix(sudo:session): session closed for user root
May 05 00:38:47 ip-10-0-105-101 filebeat[1155]: 2020-05-05T00:38:47.528Z INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"be

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 1:02am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/7 "2020-05-05T01:02:12Z")

</div>

I mean run the `metricbeat` command directly on your host and see what the output is.

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 1:45am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/8 "2020-05-05T01:45:31Z")

</div>

Finally i fixed it. Sorry for the late reply.

My mistake was so basic. When i provisioned my app instance with chef and build a image aws image, i forgot to include my beats cookbook to send data to elasticsearch. Once done that one i didnt need to activate the http forwarding.

The only thing i am missing, i can visualize only the filebeat from my app instance but not the metricbeat. Which from my kibana instance, i can see only the metric and not the filebeat. is that normal?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 1:45am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/9 "2020-05-05T01:45:53Z")

</div>

Is filebeat running?

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 1:52am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/10 "2020-05-05T01:52:49Z")

</div>

on kibana instance are both up and running..filebeat and metricbeat.

but on my app instance only filebeat is running. metricbeat no

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 1:54am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/11 "2020-05-05T01:54:06Z")

</div>

Ok then you will need to start it, or install it if it's not installed.

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 1:55am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/12 "2020-05-05T01:55:29Z")

</div>

it is installed, if i try to start the service it says:  
`sudo: unable to resolve host ip-10-0-102-48` which is the public ip of my instance

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 2:04am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/13 "2020-05-05T02:04:22Z")

</div>

That shouldn't make a difference.

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 2:07am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/14 "2020-05-05T02:07:11Z")

</div>

i dont know if this is important:

```auto
● metricbeat.service - Metricbeat is a lightweight shipper for metrics.
   Loaded: loaded (/lib/systemd/system/metricbeat.service; enabled; vendor preset: enabled)
   Active: failed (Result: start-limit-hit) since Tue 2020-05-05 02:01:29 UTC; 1s ago
     Docs: https://www.elastic.co/products/beats/metricbeat
  Process: 2417 ExecStart=/usr/share/metricbeat/bin/metricbeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=1/FAILURE)
 Main PID: 2417 (code=exited, status=1/FAILURE)

```

next to fail it says limit-hit

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 2:10am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/15 "2020-05-05T02:10:25Z")

</div>

It's heaps easier if you check the logs rather than this output, it'll usually show you what the problem is immediately.

Otherwise, try to run the Beat manually, like I mentioned above, and check its output.

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 2:14am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/16 "2020-05-05T02:14:41Z")

</div>

you are right sorry.

if i run it manually i got this:

```auto
sudo: unable to resolve host ip-10-0-102-48
Exiting: no metricsets configured for module 'http'

```

i enabled my metricbeat and set my instance ip in both field. for port 80 and port 8080

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2020, 2:17am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/17 "2020-05-05T02:17:15Z")

</div>

Please post the Metricbeat HTTP module config, as you appear to be missing something.

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 2:18am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/18 "2020-05-05T02:18:14Z")

</div>

```auto
# Module: http
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.6/metricbeat-module-http.html

- module: http
  #metricsets:
  # - json
  period: 10s
  hosts: ["3.249.247.52:80"]
  namespace: "json_namespace"
  path: "/"
  #body: ""
  #method: "GET"
  #username: "user"
  #password: "secret"
  #request.enabled: false
  #response.enabled: false
  #json.is_array: false
  #dedot.enabled: false

- module: http
  #metricsets:
  # - server
  host: "3.249.247.52"
  port: "8080"
  enabled: false
  #paths:
  # - path: "/foo"
  # namespace: "foo"
  # fields: # added to the the response in root. overwrites existing fields
  # key: "value"

```

---

<div class="post-metadata">

**Author:** ![ElAouane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elaouane/32/67612_2.png) [@ElAouane](https://discuss.elastic.co/u/ElAouane)\
**Post date:** [May 5, 2020, 2:41am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/19 "2020-05-05T02:41:33Z")

</div>

i spot my error. i didnt uncomment metricset and json

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2020, 2:41am UTC](https://discuss.elastic.co/t/metricbeat-does-not-start-service/231059/20 "2020-06-02T02:41:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.