# Unable to start FileBeat "sends log files to Logstash or directly to Elasticsearch"

**URL:** https://discuss.elastic.co/t/unable-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/220297
**Category:** Beats
**Created:** [February 21, 2020, 6:44am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/220297 "2020-02-21T06:44:03Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![DavidSanchezGracia](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DavidSanchezGracia](https://discuss.elastic.co/u/DavidSanchezGracia)
#### Post date: [February 21, 2020, 6:44am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/220297/1 "2020-02-21T06:44:04Z")

</div>

Hi, and thanks in advance for your help, I am having the following issue when starting FIleBeat on mi Ubuntu18.04 machine:

```
    `filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
   Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Thu 2020-02-20 14:00:31 UTC; 16h ago
     Docs: https://www.elastic.co/products/beats/filebeat
  Process: 26944 ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=1/FAILURE)
 Main PID: 26944 (code=exited, status=1/FAILURE)

feb 20 14:00:31 _91_ansible systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
feb 20 14:00:31 _91_ansible systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
feb 20 14:00:31 _91_ansible systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
feb 20 14:00:31 _91_ansible systemd[1]: filebeat.service: Start request repeated too quickly.
feb 20 14:00:31 _91_ansible systemd[1]: filebeat.service: Failed with result 'exit-code'.
feb 20 14:00:31 _91_ansible systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
`

```

As the error clearly said, It seems as I am defining my filebeat.yml to output to both elasticsearch and logstash. In fact, as my filebeat.yml at /etc/filebeat/filebeat.yml is defined, thats not true:

```
    #=====================Prospector Setup =======================================
filebeat.prospectors:
- type: log
  enabled: true
  paths: ["/tmp/osquery_result"]
  json.keys_under_root: true

#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 3
  #index.codec: best_compression
  #_source.enabled: false

#================================ Outputs =====================================

  #output.elasticsearch:
  # hosts: ["192.168.XX.XX:9200"]
  # username: "XXXXXX"
  # password: "XXXXX"

  #----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/logstash-forwarder.crt"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

```

Thanks all for any help you may provide, I have tested a lot of different things but none of the work out.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 20, 2020, 8:44am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/220297/2 "2020-03-20T08:44:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.