# Systemd\[1\]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch

**URL:** <https://discuss.elastic.co/t/systemd-1-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/269634>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [April 8, 2021, 6:02pm UTC](https://discuss.elastic.co/t/systemd-1-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/269634 "2021-04-08T18:02:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elam](https://avatars.discourse-cdn.com/v4/letter/e/a587f6/32.png) [@Elam](https://discuss.elastic.co/u/Elam)\
**Post date:** [April 8, 2021, 6:02pm UTC](https://discuss.elastic.co/t/systemd-1-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/269634/1 "2021-04-08T18:02:05Z")

</div>

Please some one have an idea how to start filebeats to read data from log and send it to elasticsearch.

I have this issues:

systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..

Process: 26715 ExecStart=/usr/share/filebeat/bin/filebeat $BEAT\_LOG\_OPTS $BEAT\_CONFIG\_OPTS $BEAT\_PATH\_OPTS (code=exited, status=1/FAILURE)

sudo systemctl status filebeat  
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.  
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)  
Active: failed (Result: start-limit) since Thu 2021-04-08 19:46:45 CEST; 12min ago  
Docs: [https://www.elastic.co/products/beats/filebeat](https://www.elastic.co/products/beats/filebeat)  
Process: 26715 ExecStart=/usr/share/filebeat/bin/filebeat $BEAT\_LOG\_OPTS $BEAT\_CONFIG\_OPTS $BEAT\_PATH\_OPTS (code=exited, status=1/FAILURE)  
Main PID: 26715 (code=exited, status=1/FAILURE)

Thank hyou for your help

---

<div class="post-metadata">

**Author:** ![Marius\_Iversen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_iversen/32/68988_2.png) [@Marius\_Iversen](https://discuss.elastic.co/u/Marius_Iversen)\
**Post date:** [April 14, 2021, 1:00am UTC](https://discuss.elastic.co/t/systemd-1-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/269634/2 "2021-04-14T01:00:59Z")

</div>

This means that you either have not configured an input + output in /etc/filebeat/filebeat.yml, or that it is malformed, it is complaining that it cannot find anything to do, or that it does not find an output.

If you have configured it already could you copy your filebeat.yml here, so maybe we can see where the error is?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2021, 3:01am UTC](https://discuss.elastic.co/t/systemd-1-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/269634/3 "2021-05-12T03:01:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.