# Piping Apache log line to stdin prospector panics Filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 15, 2016, 10:14am UTC](https://discuss.elastic.co/t/piping-apache-log-line-to-stdin-prospector-panics-filebeat/58017 "2016-08-15T10:14:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![tobiassjosten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tobiassjosten/32/11375_2.png) [@tobiassjosten](https://discuss.elastic.co/u/tobiassjosten)\ **Post date:** [August 15, 2016, 10:14am UTC](https://discuss.elastic.co/t/piping-apache-log-line-to-stdin-prospector-panics-filebeat/58017/1 "2016-08-15T10:14:32Z")
I want to collect logs from a remote service ([Runnable.io](http://Runnable.io)) and send them onto our ELK stack using the Runnable CLI tool and Filebeat. The first part is easy but getting Filebeat to work has been trickier than I thought. I've a tried a couple of different Filebeat configurations: ``` filebeat: prospectors: - paths: - "-" document_type: apache input_type: stdin output: logstash: hosts: ["our-secret-hostname.logit.io:11144"] ``` … or: ``` filebeat: prospectors: - input_type: stdin output: console: pretty: true ``` … and variations thereof. But when I try it, Filebeat panics: ``` $ echo '127.0.0.1 - frank [10/Oct/2000:13:55:36 -0700] "GET /asdf HTTP/1.0" 200 2326' | filebeat -v -e -c filebeat.yml 2016/08/15 09:24:46.020376 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths 2016/08/15 09:24:46.026099 logstash.go:106: INFO Max Retries set to: 3 2016/08/15 09:24:46.683087 outputs.go:126: INFO Activated logstash as output plugin. 2016/08/15 09:24:46.683427 publish.go:288: INFO Publisher name: Tobiass-MacBook-Pro.local 2016/08/15 09:24:46.683583 async.go:78: INFO Flush Interval set to: 1s 2016/08/15 09:24:46.683603 async.go:84: INFO Max Bulk Size set to: 2048 2016/08/15 09:24:46.683700 beat.go:147: INFO Init Beat: filebeat; Version: 1.2.3 2016/08/15 09:24:46.684138 beat.go:173: INFO filebeat sucessfully setup. Start running. 2016/08/15 09:24:46.684419 registrar.go:68: INFO Registry file set to: /testdir/.filebeat 2016/08/15 09:24:46.684448 registrar.go:80: INFO Loading registrar data from /testdir/.filebeat 2016/08/15 09:24:46.685104 prospector.go:133: INFO Set ignore_older duration to 0 2016/08/15 09:24:46.685119 prospector.go:133: INFO Set close_older duration to 1h0m0s 2016/08/15 09:24:46.685124 prospector.go:133: INFO Set scan_frequency duration to 10s 2016/08/15 09:24:46.685130 prospector.go:93: INFO Input type set to: stdin 2016/08/15 09:24:46.685134 prospector.go:133: INFO Set backoff duration to 1s 2016/08/15 09:24:46.685139 prospector.go:133: INFO Set max_backoff duration to 10s 2016/08/15 09:24:46.685144 prospector.go:113: INFO force_close_file is disabled 2016/08/15 09:24:46.685184 prospector.go:143: INFO Starting prospector of type: stdin 2016/08/15 09:24:46.685321 crawler.go:78: INFO All prospectors initialised with 12 states to persist 2016/08/15 09:24:46.685331 spooler.go:77: INFO Starting spooler: spool_size: 2048; idle_timeout: 5s 2016/08/15 09:24:46.685343 registrar.go:87: INFO Starting Registrar 2016/08/15 09:24:46.685364 publish.go:88: INFO Start sending events to output 2016/08/15 09:24:46.685640 log.go:113: INFO Harvester started for file: - 2016/08/15 09:24:46.686319 reader.go:87: INFO Reached end of file: /dev/stdin 2016/08/15 09:24:46.686335 log.go:157: INFO Read line error: EOF panic: runtime error: invalid memory address or nil pointer dereference [signal 0xb code=0x1 addr=0x10 pc=0x151a54] goroutine 25 [running]: panic(0x510b20, 0xc8200120d0) /usr/local/Cellar/go/1.6.2/libexec/src/runtime/panic.go:481 +0x3e6 github.com/elastic/beats/filebeat/harvester.(*Harvester).Harvest.func1(0xc8202c8800) /private/tmp/filebeat-20160531-85714-13ut0se/beats-1.2.3/gopath/src/github.com/elastic/beats/filebeat/harvester/log.go:91 +0x54 github.com/elastic/beats/filebeat/harvester.(*Harvester).Harvest(0xc8202c8800) /private/tmp/filebeat-20160531-85714-13ut0se/beats-1.2.3/gopath/src/github.com/elastic/beats/filebeat/harvester/log.go:158 +0xa7d created by github.com/elastic/beats/filebeat/harvester.(*Harvester).Start /private/tmp/filebeat-20160531-85714-13ut0se/beats-1.2.3/gopath/src/github.com/elastic/beats/filebeat/harvester/harvester.go:82 +0x35 ``` What can I be doing wrong? I've tried this both on Mac and Ubuntu (Filebeat v1.2.3) but both show the same error. ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [August 15, 2016, 12:24pm UTC](https://discuss.elastic.co/t/piping-apache-log-line-to-stdin-prospector-panics-filebeat/58017/2 "2016-08-15T12:24:31Z")
Thanks for the report. This seems indeed to be a bug affecting version 1.2.3 if the stdin reader encounters EOF. This bug doesn't exist in the 5.0.0-alpha5, so you can use that if it's an option. We're also working on a fix for 1.3. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [August 16, 2016, 2:16pm UTC](https://discuss.elastic.co/t/piping-apache-log-line-to-stdin-prospector-panics-filebeat/58017/3 "2016-08-16T14:16:13Z")
Bug was fixed here: [https://github.com/elastic/beats/pull/2268](https://github.com/elastic/beats/pull/2268) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 5, 2016, 10:14am UTC](https://discuss.elastic.co/t/piping-apache-log-line-to-stdin-prospector-panics-filebeat/58017/4 "2016-09-05T10:14:42Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.