# \[Solved\] Data path already locked by another beat

**URL:** <https://discuss.elastic.co/t/solved-data-path-already-locked-by-another-beat/262018>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 24, 2021, 2:18am UTC](https://discuss.elastic.co/t/solved-data-path-already-locked-by-another-beat/262018 "2021-01-24T02:18:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfasajr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jfasajr/32/82472_2.png) [@jfasajr](https://discuss.elastic.co/u/jfasajr)\
**Post date:** [January 24, 2021, 2:18am UTC](https://discuss.elastic.co/t/solved-data-path-already-locked-by-another-beat/262018/1 "2021-01-24T02:18:24Z")

</div>

I'm not particularly sure what to do about the following error. I've read a few things and everyone seems to say that it's either a failed shutdown or second instance. However none of my troubleshooting has rendered results. Maybe there is a path being pulled in by another system, but not beats from what I can tell.

```auto
2021-01-24T02:21:36.654Z INFO instance/beat.go:645 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2021-01-24T02:21:36.655Z INFO instance/beat.go:653 Beat ID: 3069bcba-8e20-429f-8d2e-5030c0d1aad2
2021-01-24T02:21:36.660Z INFO instance/beat.go:392 filebeat stopped.
2021-01-24T02:21:36.660Z ERROR instance/beat.go:956 Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).

```

- I've restarted (and stopped/started separately) the Service,
- Don't see a second service for filebeat or anything else with "beat" in the name of services running.
- I wasn't getting this error when filebeat was going straight through to Elasticsearch, however I wanted to have it go to logstash first (and in the future other plugins/beats for their own indices to visualize in kibana later). Now that I've switched some of the filebeats.yml file, this has started.

filebeat.yml:

```auto
filebeat.inputs:

- module: system
  # Syslog
  syslog:
    enabled: true

  auth:
    enabled: true

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

#setup.template.name: "nginx"
#setup.template.pattern: "nginx-%{[agent.version]}-%{+yyyy.MM.dd}-*"

#setup.template.settings:
# index.number_of_shards: 1

setup.kibana:
  host: http://134.122.15.171:5601
  username: "${KIBANA_USER}"
  password: "${KIBANA_PWD}"

#output.elasticsearch:
# hosts: ["localhost:9200"]
# index: "nginx-%{+yyyy.MM.dd}"
# username: "${ES_USER}"
# password: "${ES_PWD}"

output.logstash:
   enabled: true
   hosts: ["localhost:5044"]
   index: 'filebeat'

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

```

modules.d/nginx.yml:

```auto
# Module: nginx
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.10/filebeat-module-nginx.html

- module: nginx
  # Access logs
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths: ["/var/log/nginx/access.log*"]

  # Error logs
  error:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:["/var/log/nginx/error.log*"]

  # Ingress-nginx controller logs. This is disabled by default. It could be used in Kubernetes environments to parse ingress-nginx logs
  ingress_controller:
    enabled: false

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

```

This occurs when I run `filebeat -e`, I try to run `filebeat setup -e` and that seems to trigger another issue shown below:

```auto
ERROR instance/beat.go:956 Exiting: Index management requested but the Elasticsearch output is not configured/enabled
Exiting: Index management requested but the Elasticsearch output is not configured/enabled

```

Please let me know if there are other log/config files you would like me to include and I certainly can add them here.

---

<div class="post-metadata">

**Author:** ![jfasajr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jfasajr/32/82472_2.png) [@jfasajr](https://discuss.elastic.co/u/jfasajr)\
**Post date:** [January 24, 2021, 2:33am UTC](https://discuss.elastic.co/t/solved-data-path-already-locked-by-another-beat/262018/2 "2021-01-24T02:33:40Z")

</div>

Ignore me, while I'm on to new issues, the solution was just to restart all of my Elastic Stack in this order:  
Elasticsearch  
Kibana  
Logstash  
Filebeat

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2021, 4:33am UTC](https://discuss.elastic.co/t/solved-data-path-already-locked-by-another-beat/262018/3 "2021-02-21T04:33:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.