# Not able to start filebeat
**URL:** https://discuss.elastic.co/t/not-able-to-start-filebeat/169597
**Category:** Beats
**Created:** [February 22, 2019, 2:50pm UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597 "2019-02-22T14:50:07Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@rajesh-321](https://discuss.elastic.co/u/rajesh-321)
#### Post date: [February 22, 2019, 2:50pm UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/1 "2019-02-22T14:50:07Z")
Hi Team
I am not able to start the filebeat service. below is the error I am getting
[root@inmbz1196 config]# service filebeat status
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Fri 2019-02-22 09:33:46 EST; 782ms ago
Docs: [https://www.elastic.co/products/beats/filebeat](https://www.elastic.co/products/beats/filebeat)
Process: 1972 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
Main PID: 1972 (code=exited, status=1/FAILURE)
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Unit filebeat.service entered failed state.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service failed.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service holdoff time over, scheduling restart.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: start request repeated too quickly for filebeat.service
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Unit filebeat.service entered failed state.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service failed.
[root@inmbz1196 config]#
hence I am trying to get logs from localhost, please find the log stash configuration below
input {
tcp {
port =\> 5000
type =\> syslog
}
udp {
port =\> 5000
type =\> syslog
}
}
filter {
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
output {
elasticsearch { hosts =\> ["localhost:9200"] }
stdout { codec =\> rubydebug }
Please suggest I am totally new to ELK
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 22, 2019, 2:54pm UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/2 "2019-02-22T14:54:55Z")
Which version are you using? Which operating system?
---
### Author:  [@rajesh-321](https://discuss.elastic.co/u/rajesh-321)
#### Post date: [February 22, 2019, 5:04pm UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/3 "2019-02-22T17:04:10Z")
{
"name" : "EgQBZmC",
"cluster\_name" : "my-application",
"cluster\_uuid" : "UtlmNtFCQjWmfG6zqi8CGg",
"version" : {
"number" : "6.6.0",
"build\_flavor" : "default",
"build\_type" : "tar",
"build\_hash" : "a9861f4",
"build\_date" : "2019-01-24T11:27:09.439740Z",
"build\_snapshot" : false,
"lucene\_version" : "7.6.0",
"minimum\_wire\_compatibility\_version" : "5.6.0",
"minimum\_index\_compatibility\_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
Linux Operating systems
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 22, 2019, 5:14pm UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/4 "2019-02-22T17:14:28Z")
Exactly which Linux type and version?
---
### Author:  [@rajesh-321](https://discuss.elastic.co/u/rajesh-321)
#### Post date: [February 22, 2019, 6:39pm UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/5 "2019-02-22T18:39:38Z")
Hi
Red Hat Enterprise Linux Server release 7.6 (Maipo)
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [February 22, 2019, 6:40pm UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/6 "2019-02-22T18:40:18Z")
Is there anything in the Filebeat logs?
---
### Author:  [@rajesh-321](https://discuss.elastic.co/u/rajesh-321)
#### Post date: [February 26, 2019, 9:09am UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/7 "2019-02-26T09:09:41Z")
I have seen below error in log stash logs
cified
[2019-02-22T09:32:04,491][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"6.6.0"}
[2019-02-22T09:32:06,654][INFO][logstash.config.source.local.configpathloader] No config files found in path {:path=\>"/tmp/logstash/logstash-6.6.0/logstash.conf"}
---
### Author:  [@rajesh-321](https://discuss.elastic.co/u/rajesh-321)
#### Post date: [February 26, 2019, 9:10am UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/8 "2019-02-26T09:10:24Z")
filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Fri 2019-02-22 09:33:46 EST; 3 days ago
Docs: [https://www.elastic.co/products/beats/filebeat](https://www.elastic.co/products/beats/filebeat)
Main PID: 1972 (code=exited, status=1/FAILURE)
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Unit filebeat.service entered failed state.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service failed.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service holdoff time over, scheduling restart.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: start request repeated too quickly for filebeat.service
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: Unit filebeat.service entered failed state.
Feb 22 09:33:46 [inmbz1196.in.dst.ibm.com](http://inmbz1196.in.dst.ibm.com) systemd[1]: filebeat.service failed.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 26, 2019, 11:10am UTC](https://discuss.elastic.co/t/not-able-to-start-filebeat/169597/9 "2019-03-26T11:10:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.