# Needs to restart everytime filebeat in order to send log to logstash

**URL:** <https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 20, 2016, 9:39am UTC](https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487 "2016-10-20T09:39:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fferraro87](https://avatars.discourse-cdn.com/v4/letter/f/f07891/32.png) [@fferraro87](https://discuss.elastic.co/u/fferraro87)\
**Post date:** [October 20, 2016, 9:39am UTC](https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487/1 "2016-10-20T09:39:12Z")

</div>

Hi i've same problem of this thread : [Filebeat Need Restart To send Logs](https://discuss.elastic.co/t/filebeat-need-restart-to-send-logs/60266) but i doesn't see solution on that thread, so i've this filebeat.yml :

```
filebeat:
  prospectors:
    -
      paths:
      - /var/log/syslog
      - /var/log/auth.log
      - /var/log/maillog
      input_type: log
      document_type: syslog
      scan_frequency: 60s
    -
      paths:
      - /var/log/zimbra.log
      input_type: log
      document_type: postfix
      scan_frequency: 60s
    -
      paths:
      - /var/log/zimbra.log
      input_type: log
      document_type: postfix
      fields:
        tags: "saslauthd"
      scan_frequency: 60s
    -
      paths:
      - /var/log/zimbra.log
      input_type: log
      document_type: postfix
      fields:
        tags: "amavis"
      scan_frequency: 60s
    -
      paths:
      - /opt/zimbra/log/audit.log
      input_type: log
      document_type: zimbra_audit
      scan_frequency: 60s
    -
      paths:
      - /opt/zimbra/log/mailbox.log
      input_type: log
      document_type: zimbra_mailbox
      scan_frequency: 60s

  registry_file: /var/lib/filebeat/registry
############################# Output ##########################################

output:

  elasticsearch:

    hosts: ["localhost:9200"]
 ### Logstash as output
  logstash:
    # The Logstash hosts
    hosts: ["172.16.70.33:5044"]

    bulk_max_size: 1024

    tls:
      # List of root certificates for HTTPS server verifications
      certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
############################# Shipper #########################################

shipper:
############################# Logging #########################################
logging:

  to_syslog: false

  to_files: true

  files:

    path: /var/log/filebeat

    name: filebeat.log

    rotateeverybytes: 10485760 # = 10MB

    keepfiles: 7

  level: debug

```

but everytime i need to restart filebeat.

from log i see only this error :

> 2016/10/20 09:20:50.583052 client.go:297: DBG ES Ping(url=[http://localhost:9200](http://localhost:9200), timeout=1m30s)  
> 2016/10/20 09:20:50.583929 client.go:302: DBG Ping request failed with: Head [http://localhost:9200](http://localhost:9200): dial tcp 127.0.0.1:9200: getsockopt: connection refused

i've elasticsearch installed on another server, same of logstash

can you help me?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 20, 2016, 9:44am UTC](https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487/2 "2016-10-20T09:44:55Z")

</div>

If your intention is to send to ES via Logstash, why do you have a elasticsearch output defined in your Filebeat configuration? And pointed at localhost where you don't seem to be running Elasticsearch? Remove it.

---

<div class="post-metadata">

**Author:** ![fferraro87](https://avatars.discourse-cdn.com/v4/letter/f/f07891/32.png) [@fferraro87](https://discuss.elastic.co/u/fferraro87)\
**Post date:** [October 21, 2016, 7:01am UTC](https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487/3 "2016-10-21T07:01:37Z")

</div>

yeah thanks i really don't see it,  
thanks a lot again

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2016, 9:39am UTC](https://discuss.elastic.co/t/needs-to-restart-everytime-filebeat-in-order-to-send-log-to-logstash/63487/4 "2016-11-10T09:39:16Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.