# Problem with filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 3, 2017, 5:38am UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589 "2017-07-03T05:38:56Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![cdfwb1992](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@cdfwb1992](https://discuss.elastic.co/u/cdfwb1992)\ **Post date:** [July 3, 2017, 5:38am UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/1 "2017-07-03T05:38:56Z")
Hi, I followed this tutorial "[https://www.elastic.co/guide/en/beats/filebeat/5.4/filebeat-getting-started.html](https://www.elastic.co/guide/en/beats/filebeat/5.4/filebeat-getting-started.html)" step by step, but Kibana shows me 0 hits and No results found. ---
**Author:** ![Pandiyan\_M](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pandiyan_m/32/19404_2.png) [@Pandiyan\_M](https://discuss.elastic.co/u/Pandiyan_M)\ **Post date:** [July 3, 2017, 10:14am UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/2 "2017-07-03T10:14:14Z")
Configure filebeat.yml with log file path and map it to ELK server ( single node) in output under filebeat.yml, then give some entry inside log path and check it will get reflected in kibana, there will be 30 sec time out. 🙂 ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 3, 2017, 1:43pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/3 "2017-07-03T13:43:42Z")
your setup is filebeat-\>Elasticsearch? Have you had a look at the filebeat log output? ---
**Author:** ![cdfwb1992](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@cdfwb1992](https://discuss.elastic.co/u/cdfwb1992)\ **Post date:** [July 3, 2017, 3:08pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/5 "2017-07-03T15:08:52Z")
ye, I use filebeat-\>Elasticsearch. I am really new to this, do you mean logs in /var/log/filebeat? I don't know which filebeat log output I can refer to. ---
**Author:** ![cdfwb1992](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@cdfwb1992](https://discuss.elastic.co/u/cdfwb1992)\ **Post date:** [July 3, 2017, 3:16pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/6 "2017-07-03T15:16:28Z")
My filebeat.yml is like: filebeat.prospectors: - input\_type: log paths: - /var/log/\*.log output.elasticsearch: hosts: ["192.168.1.42:9200"] Is it what you are saying? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 4, 2017, 10:53am UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/7 "2017-07-04T10:53:56Z")
yes, `/var/log/filebeat` contains the filebeats log output. ---
**Author:** ![cdfwb1992](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@cdfwb1992](https://discuss.elastic.co/u/cdfwb1992)\ **Post date:** [July 4, 2017, 8:11pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/8 "2017-07-04T20:11:35Z")
My log file is like this: 2017-07-04T15:14:50-04:00 INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat] 2017-07-04T15:14:50-04:00 INFO Setup Beat: filebeat; Version: 5.4.3 2017-07-04T15:14:50-04:00 INFO Loading template enabled. Reading template file: /etc/filebeat/filebeat.template.json 2017-07-04T15:14:50-04:00 INFO Metrics logging every 30s 2017-07-04T15:14:50-04:00 INFO Loading template enabled for Elasticsearch 2.x. Reading template file: /etc/filebeat/filebeat.template-es2x.json 2017-07-04T15:14:50-04:00 INFO Loading template enabled for Elasticsearch 6.x. Reading template file: /etc/filebeat/filebeat.template-es6x.json 2017-07-04T15:14:50-04:00 INFO Elasticsearch url: [http://192.168.1.42:9200](http://192.168.1.42:9200) 2017-07-04T15:14:50-04:00 INFO Activated elasticsearch as output plugin. 2017-07-04T15:14:50-04:00 INFO Publisher name: wenbo-VirtualBox 2017-07-04T15:14:50-04:00 INFO Flush Interval set to: 1s 2017-07-04T15:14:50-04:00 INFO Max Bulk Size set to: 50 2017-07-04T15:14:51-04:00 INFO filebeat start running. 2017-07-04T15:14:51-04:00 INFO Registry file set to: /var/lib/filebeat/registry 2017-07-04T15:14:51-04:00 INFO Loading registrar data from /var/lib/filebeat/registry 2017-07-04T15:14:51-04:00 INFO States Loaded from registrar: 2 2017-07-04T15:14:51-04:00 INFO Loading Prospectors: 1 2017-07-04T15:14:51-04:00 INFO Prospector with previous states loaded: 0 2017-07-04T15:14:51-04:00 INFO Starting prospector of type: log; id: 1462193845342389316 2017-07-04T15:14:51-04:00 INFO Loading and starting Prospectors completed. Enabled prospectors: 1 2017-07-04T15:14:51-04:00 INFO Start sending events to output 2017-07-04T15:14:51-04:00 INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s 2017-07-04T15:14:51-04:00 INFO Starting Registrar 2017-07-04T15:14:52-04:00 INFO Harvester started for file: /home/wenbo/Desktop/Tap-News/web\_server/logs/main.log 2017-07-04T15:15:16-04:00 INFO Non-zero metrics in the last 30s: filebeat.harvester.open\_files=1 filebeat.harvester.running=1 filebeat.harvester.started=1 libbeat.publisher.published\_events=10 2017-07-04T15:15:46-04:00 INFO No non-zero metrics in the last 30s 2017-07-04T15:16:16-04:00 INFO No non-zero metrics in the last 30s 2017-07-04T15:16:21-04:00 ERR Connecting error publishing events (retrying): Get [http://192.168.1.42:9200](http://192.168.1.42:9200): net/http: request canceled while waiting for connection 2017-07-04T15:16:46-04:00 INFO No non-zero metrics in the last 30s 2017-07-04T15:17:16-04:00 INFO No non-zero metrics in the last 30s 2017-07-04T15:17:46-04:00 INFO No non-zero metrics in the last 30s 2017-07-04T15:17:52-04:00 ERR Connecting error publishing events (retrying): Get [http://192.168.1.42:9200](http://192.168.1.42:9200): net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) 2017-07-04T15:18:16-04:00 INFO No non-zero metrics in the last 30s 2017-07-04T15:18:46-04:00 INFO No non-zero metrics in the last 30s 2017-07-04T15:19:16-04:00 INFO No non-zero metrics in the last 30s ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 5, 2017, 12:04pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/9 "2017-07-05T12:04:32Z")
See error message: ```auto Get http://192.168.1.42:9200: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) ``` Seems to be a problem with Elasticsearch. Either it's not running (correctly) or not at all. You can try to increase the `output.elasticsearch.timeout: 60s` from default to 60s to much some higher value. But ultimately you want need to check Elasticsearch being available. Have you tried `curl http://192.168.1.42:9200` ? ---
**Author:** ![cdfwb1992](https://avatars.discourse-cdn.com/v4/letter/c/977dab/32.png) [@cdfwb1992](https://discuss.elastic.co/u/cdfwb1992)\ **Post date:** [July 5, 2017, 4:29pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/10 "2017-07-05T16:29:11Z")
Ye, I have tried 'curl [http://192.168.1.42:9200](http://192.168.1.42:9200) ', it works fine. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [July 5, 2017, 7:38pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/11 "2017-07-05T19:38:39Z")
have you tried to increase the timeout? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 2, 2017, 7:38pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589/12 "2017-08-02T19:38:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.