# Not able to start, remove the filebeat

**URL:** <https://discuss.elastic.co/t/not-able-to-start-remove-the-filebeat/208113>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 15, 2019, 5:32pm UTC](https://discuss.elastic.co/t/not-able-to-start-remove-the-filebeat/208113 "2019-11-15T17:32:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![newafounder](https://avatars.discourse-cdn.com/v4/letter/n/c5a1d2/32.png) [@newafounder](https://discuss.elastic.co/u/newafounder)\
**Post date:** [November 15, 2019, 5:32pm UTC](https://discuss.elastic.co/t/not-able-to-start-remove-the-filebeat/208113/1 "2019-11-15T17:32:31Z")

</div>

Hi, so i have ansible playbook install filebeat agent on a server. After installation, i went to check the service and it was working fine. But then i manually stopped the service and starting again, afterwards i have getting the Active: failed (Result: start-limit) error even if i run the playbook again with deleting all the files and folders of filebeat. Please advise.

$ service filebeat status  
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.  
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)  
Active: failed (Result: start-limit) since Fri 2019-11-15 10:26:48 MST; 23s ago  
Docs: [https://www.elastic.co/products/beats/filebeat](https://www.elastic.co/products/beats/filebeat)  
Process: 7545 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)  
Main PID: 7545 (code=exited, status=1/FAILURE)

Here is the filebeat.yml

############################# Filebeat ######################################

filebeat.registry\_file: /var/lib/filebeat/registry  
filebeat.config\_dir: /etc/filebeat/conf.d

############################# Output ##########################################

output.logstash.hosts: ["#hostnameA:5044", "#hostnameB:5044"]  
output.logstash.loadbalance: true  
output.logstash.index: filebeat

############################# Logging #########################################

logging.level: info  
logging.to\_files: false  
logging.to\_syslog: true  
logging.metrics.enabled: true  
logging.metrics.period: 5m  
logging.files.path: /var/log/filebeat  
logging.files.rotateeverybytes: 10485760  
logging.files.keepfiles: 7

---

<div class="post-metadata">

**Author:** ![newafounder](https://avatars.discourse-cdn.com/v4/letter/n/c5a1d2/32.png) [@newafounder](https://discuss.elastic.co/u/newafounder)\
**Post date:** [November 15, 2019, 6:21pm UTC](https://discuss.elastic.co/t/not-able-to-start-remove-the-filebeat/208113/2 "2019-11-15T18:21:21Z")

</div>

i have attached the partial log when i run $ filebeat -v -e -d "\*"

INFO instance/beat.go:280 Setup Beat: filebeat; Version: 6.8.0  
DEBUG [beat] instance/beat.go:301 Initializing output plugins  
DEBUG [processors] processors/processor.go:66 Processors:  
DEBUG [publish] pipeline/consumer.go:137 start pipeline event consumer  
INFO [publisher] pipeline/module.go:110 Beat name: #[hostname.domain.com](http://hostname.domain.com)  
WARN [cfgwarn] config/config.go:132 DEPRECATED: config\_dir is deprecated. Use `filebeat.config.inputs` instead. Will be removed in version: 7.0.0  
INFO config/config.go:138 Additional config files are fetched from: /etc/filebeat/conf.d  
INFO instance/beat.go:359 filebeat stopped.  
ERROR instance/beat.go:906 Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?  
Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?

---

<div class="post-metadata">

**Author:** ![kumarabhi](https://avatars.discourse-cdn.com/v4/letter/k/6a8cbe/32.png) [@kumarabhi](https://discuss.elastic.co/u/kumarabhi)\
**Post date:** [November 21, 2019, 9:47pm UTC](https://discuss.elastic.co/t/not-able-to-start-remove-the-filebeat/208113/3 "2019-11-21T21:47:25Z")

</div>

@newafounder: I too may have faced a similar problem after upgrading to latest version (7.4).

The is a module foldr and the contents are below (ls module/)  
apache auditd haproxy iis kibana mongodb nats osquery redis system  
apache2 elasticsearch icinga kafka logstash mysql nginx postgresql santa traefik

The module folder used to be inside /usr/share/filebeat/bin and with latest release it is expected to be outside of bin folder (/usr/share/filebeat).

Please try it and see if it works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2019, 9:47pm UTC](https://discuss.elastic.co/t/not-able-to-start-remove-the-filebeat/208113/4 "2019-12-19T21:47:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.