# Using Filebeat with Logstash breaks Metricbeat
**URL:** https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363
**Category:** Beats
**Tags:** filebeat
**Created:** [August 15, 2019, 2:48pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363 "2019-08-15T14:48:18Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [August 15, 2019, 2:48pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/1 "2019-08-15T14:48:18Z")
I'm using a default configuration for Filebeat, and a standard configuration for logstash to input from beats and output to elasticsearch.
Metricbeat works fine, but once I start an instance of Filebeat, the metricbeat Infrastructure visualization breaks.
Could it be an index I need to change? Do I need to do some special setup that I'm missing? Thank you in advance, this has been breaking our system for weeks.
---
### Author:  [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [August 20, 2019, 7:21pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/2 "2019-08-20T19:21:21Z")
Metricbeat and filebeat should be largely independent. Can you share the configurations that are causing trouble? (`filebeat.yml` and `metricbeat.yml`)
---
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [August 21, 2019, 1:08pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/3 "2019-08-21T13:08:59Z")
Sure.
filebeat.yml:
```
filebeat.inputs:
- type: log
enabled: true
paths:
-/my/log/path/log.out
filebeat.config:
modules:
enabled: false
path: modules.d/*.yml
#output.elasticsearch.hosts: ["ESHOST1:9200", "ESHOST2:9200", "ESHOST3:9200"]
output.logstash.hosts: ["LSHOST:5044"]
setup.kibana:
host: "KHOST: 5601"
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch:
hosts: ["ESHOST1:9200", "ESHOST2:9200", "ESHOST3:9200"]
```
metricbeat.yml:
```
metricbeat.max_start_delay: 10s
metricbeat.modules:
- module: system
metricsets:
- cpu
- load
- memory
- network
- process
- process_summary
- uptime
- socket_summary
period: 10s
process.include_top_n:
by_cpu: 5
by_memory: 5
- module: system
period: 1m
metricsets:
- filesystem
- fsstat
processors:
- drop_event.when.regexp:
system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'
- module: system
period: 15m
metricsets:
- uptime
- module: system
period: 10s
metricsets: ["diskio"]
- module: docker
period: 10s
hosts: ["unix:///var/run/docker.sock"]
#output.elasticsearch.hosts: ["ESHOST1:9200", "ESHOST2:9200", "ESHOST3:9200"]
output.logstash.hosts: ["LSHOST:5044"]
setup.kibana:
host: "KHOST:5601"
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch:
hosts: ["ESHOST1:9200","ESHOST2:9200", "ESHOST3:9200"]
```
---
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [August 22, 2019, 2:52pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/4 "2019-08-22T14:52:14Z")
Even after stopping all filebeats and deleting the indices, the metricbeat data still doesn't show up in kibana. I am unable to delete the template using curl, it seems to not actually delete despite returning `{"acknowledged":true}`
To be clear, if I don't initially set up or start any filebeats, metricbeat works perfectly.
---
### Author:  [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [August 22, 2019, 6:06pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/5 "2019-08-22T18:06:58Z")
Ah, can you share your logstash configuration as well? (Have you tried sending directly to elasticsearch rather than logstash?) If logstash is somehow routing filebeat data to the same place as metricbeat that could definitely break visualizations 🙂
---
### Author:  [@kumarabhi](https://discuss.elastic.co/u/kumarabhi)
#### Post date: [August 23, 2019, 12:11am UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/6 "2019-08-23T00:11:51Z")
Hi Carson,
Why don't you send the events (from Filebeat and MetricsBeat) to different ES indexes ?
[https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html)
Please use index field to set the value
---
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [August 26, 2019, 12:24pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/7 "2019-08-26T12:24:38Z")
I believe I am using different indexes, with this configuration:
`beats-filter.conf`:
```
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["ESHOST1:9200", "ESHOST2:9200", "ESHOST3:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
```
---
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [August 26, 2019, 1:12pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/8 "2019-08-26T13:12:12Z")
If I don't need to use logstash (which I think I can get away with using ingest node + grok processor) I could try sending directly to ES
---
### Author:  [@kumarabhi](https://discuss.elastic.co/u/kumarabhi)
#### Post date: [August 26, 2019, 5:30pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/9 "2019-08-26T17:30:24Z")
Thanks for sharing Logstash config. It looks perfectly fine to me.
I suggest you to go to Kibana and look at the input data for metricsbeat index.
There should not be any conflicts with Filebeat and Metricsbeat running together and sending data to Logstash.
---
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [August 26, 2019, 7:21pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/10 "2019-08-26T19:21:32Z")
How do I go about doing that? I'm not sure what you mean by "look at the input data"
---
### Author:  [@carson](https://discuss.elastic.co/u/carson)
#### Post date: [August 26, 2019, 7:24pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/11 "2019-08-26T19:24:38Z")
Update: Deleting the index using CURL seemed to work. For some reason the new index is not broken. Very strange issue that i'll continue to monitor.
If anyone has further ideas as to what's happening that'd be helpful
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 23, 2019, 7:24pm UTC](https://discuss.elastic.co/t/using-filebeat-with-logstash-breaks-metricbeat/195363/12 "2019-09-23T19:24:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.