# Stashing my first pipeline with Filebeat and Logstash

**URL:** https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828
**Category:** Beats
**Tags:** filebeat
**Created:** [January 17, 2018, 5:28am UTC](https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828 "2018-01-17T05:28:02Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Suryakumar](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Suryakumar](https://discuss.elastic.co/u/Suryakumar)
#### Post date: [January 17, 2018, 5:28am UTC](https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828/1 "2018-01-17T05:28:02Z")

</div>

Hi,

I have just started using elasticsearch. I am now trying the first example with Filebeats and logstash as given in this tutorial : [[https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html.]](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html.%5D)

I am facing two difficulties.

 ![Filebeat_error](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c5e0eeea1c05cb04757a0068fc7754d29d717866.png)

- First I cannot find data registry file as mentioned in the tutorial.
- Second as I followed other steps except the deletion of data registry file mentioned above, but I am not getting the expected output.  
Rather I got this error message.(Image)

Please help me out to solve this.

Note: I am using Ubuntu 16.04

Thanks,  
Suryakumar

---

<div class="post-metadata">

### Author: ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [January 17, 2018, 6:02am UTC](https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828/2 "2018-01-17T06:02:11Z")

</div>

You can find the data registry file in the `/var/lib/filebeat/` directory, which needs root permissions to be accessed.

Try to follow the complete steps again now that you have access to the registry.

If after that you are still facing problems, please provide the full debug log (run with `-d "*"` instead of `-d publish`) so we can check if there are any problems submitting events to logstash.

Also, paste the output of `curl -XGET 'localhost:9200/_cat/shards'` to see which indexes get created.

---

<div class="post-metadata">

### Author: ![Suryakumar](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Suryakumar](https://discuss.elastic.co/u/Suryakumar)
#### Post date: [January 17, 2018, 7:11am UTC](https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828/3 "2018-01-17T07:11:36Z")

</div>

Thank you so much for your reply @adrisr.. Yes that is the problem. I navigated to `/var/lib/filebeat/` , deleted the registry and continued the steps again. Now it is working fine.

Thanks again!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2018, 7:11am UTC](https://discuss.elastic.co/t/stashing-my-first-pipeline-with-filebeat-and-logstash/115828/4 "2018-02-14T07:11:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.