# Unable to start filebeat service

**URL:** <https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089>\
**Category:** Beats\
**Tags:** filebeat, metricbeat\
**Created:** [April 24, 2022, 9:10am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089 "2022-04-24T09:10:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhagavat\_Bhise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhagavat_bhise/32/99284_2.png) [@Bhagavat\_Bhise](https://discuss.elastic.co/u/Bhagavat_Bhise)\
**Post date:** [April 24, 2022, 9:10am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089/1 "2022-04-24T09:10:52Z")

</div>

Hi Team,

I am facing an issue while starting filebeat service, getting below error.

Would you please help me on this?

Please find below details for your help.

Apr 24 08:45:55 elku systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE  
Apr 24 08:45:55 elku systemd[1]: filebeat.service: Failed with result 'exit-code'.  
Apr 24 08:45:55 elku systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.  
Apr 24 08:45:55 elku systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.  
Apr 24 08:45:55 elku systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..  
Apr 24 08:45:55 elku systemd[1]: filebeat.service: Start request repeated too quickly.  
Apr 24 08:45:55 elku systemd[1]: filebeat.service: Failed with result 'exit-code'.  
Apr 24 08:45:55 elku systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearc  
lines 1-15/15 (END)

Filebeat.yml:

```auto
###################### Filebeat Configuration Example #########################
# This file is an example configuration file highlighting only the most common
# options. The filebeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/filebeat/index.html
# For more available modules and options, please see the filebeat.reference.yml sample
# configuration file.
# ============================== Filebeat inputs ===============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
# filestream is an input for collecting log messages from files.
- type: filestream
  # Change to true to enable this input configuration.
  enabled: false
  # Paths that should be crawled and fetched. Glob based paths.
  paths: - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*
  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.

  #exclude_lines: ['^DBG']
  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  #include_lines: ['^ERR', '^WARN']
  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  #prospector.scanner.exclude_files: ['.gz$']
  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  #fields:
  # level: debug
  # review: 1

# ============================== Filebeat modules ==============================                             

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml
  # Set to true to enable config reloading
  reload.enabled: false
  # Period on which files under path should be checked for changes
  #reload.period: 10s
# ======================= Elasticsearch template setting =======================

setup.template.settings:
  index.number_of_shards: 1
  #index.codec: best_compression
  #_source.enabled: false
# ================================== General ===================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:
# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]
# Optional fields that you can specify to add additional information to the
# output.
#fields:
# env: staging

# ================================= Dashboards =================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here or by using the `setup` command.
#setup.dashboards.enabled: false
# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

# =================================== Kibana ===================================
# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"
  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
 #space.id:

# =============================== Elastic Cloud ================================
# These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).
# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:
# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:
# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------

# Configure what output to use when sending the data collected by the beat.
# ---------------------------- Elasticsearch Output ----------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  #username: "elastic"
  #password: "changeme"

# ------------------------------ Logstash Output -------------------------------

output.logstash:
  # The Logstash hosts
  #hosts: ["localhost:5044"]
  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"
  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

# ================================== Logging ===================================

# Set

```

s log level. The default log level is info.

# Available log levels are: error, warning, info, debug

#logging.level: debug

# At debug level, you can selectively enable logging only for some components.

# To enable all selectors use ["\*"]. Examples of other selectors are "beat",

# "publisher", "service".

#logging.selectors: ["\*"]

# ============================= X-Pack Monitoring ==============================

# Filebeat can export internal metrics to a central Elasticsearch monitoring

# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The

# reporting is disabled by default.

# Set to true to enable the monitoring reporter.

#monitoring.enabled: false

# Sets the UUID of the Elasticsearch cluster under which monitoring data for this

# Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch

# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.

#monitoring.cluster\_uuid:

```auto

`> List item`

```

```auto
type or paste code here

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 26, 2022, 1:04am UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089/2 "2022-04-26T01:04:44Z")

</div>

Welcome to our community! 😃  
Please format your code/logs/config using the `</>` button, or markdown style back ticks. It helps to make things easy to read which helps us help you 🙂

What do your Filebeat logs show?

---

<div class="post-metadata">

**Author:** ![Bhagavat\_Bhise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhagavat_bhise/32/99284_2.png) [@Bhagavat\_Bhise](https://discuss.elastic.co/u/Bhagavat_Bhise)\
**Post date:** [April 26, 2022, 2:36pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089/3 "2022-04-26T14:36:56Z")

</div>

Hi Warkolm,

Thanks for your help, it's working now. I have done some changes in filebeat.yml file and it starts working.

Cheers!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2022, 4:37pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-service/303089/4 "2022-05-24T16:37:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.