# Why file always get this error ,it makes puzzle two day

**URL:** <https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 25, 2018, 9:05am UTC](https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008 "2018-01-25T09:05:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericchuhong](https://avatars.discourse-cdn.com/v4/letter/e/d78d45/32.png) [@ericchuhong](https://discuss.elastic.co/u/ericchuhong)\
**Post date:** [January 25, 2018, 9:05am UTC](https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008/1 "2018-01-25T09:05:14Z")

</div>

![IMG20180125_170102](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1faba8ebd9df81000c21942759434f7b2c300b66.png)  
I just simply cofigure logstash and filebeat like follow:  
filebeat :  
#output.logstash:

# The Logstash hosts

hosts: ["localhost:5043"],  
and logstash :  
input {  
beats {  
host =\> "localhost"  
port =\> "5043" #注意要和filebeat的输出端口一致  
}  
}  
output {  
stdout { codec =\> rubydebug }  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}  
Is there any thing wrong with this simply setting ,It almost make me crazy.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 25, 2018, 9:36am UTC](https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008/2 "2018-01-25T09:36:18Z")

</div>

From the provided screenshot and filebeat config, it seems to me that you're passing localhost:5034 as the Elasticsearch host and not Logstash host.

you must uncomment the `output.logstash:` line before the `hosts:` line.

If this is not the case, please paste your full configuration again, this time wrapping it in a block quote (prefix every line with the \> sign )

---

<div class="post-metadata">

**Author:** ![ericchuhong](https://avatars.discourse-cdn.com/v4/letter/e/d78d45/32.png) [@ericchuhong](https://discuss.elastic.co/u/ericchuhong)\
**Post date:** [January 25, 2018, 10:13am UTC](https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008/3 "2018-01-25T10:13:23Z")

</div>

thx for apply,I find that I miss set filebeat.prospectors to be enable, so filebeat did not send logs.  
after change it to enable I trouble with other problem .

 ![snipaste20180125_180835](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3bc973d21c737837ddb24393e9e6f945dab84d75.png) ![snipaste20180125_180858](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9ea75608b532a7a8e3901b198772c24f85371355.png)

while my cofigure file about filebeat.yml and logstash.conf is follow  
 ![snipaste20180125_180655](https://us1.discourse-cdn.com/elastic/original/3X/1/7/1790e83ae2f36bdf5635679c23271c3db26839a3.png) ![snipaste20180125_180745](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ead20815682e86190a5b6c1c0150ee50265f2087.png) ![snipaste20180125_180805](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b3b292a7a6a286570a730b0ff7b78dcbdebff639.png)  
Could you help me check out what wrong with this

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 25, 2018, 10:28am UTC](https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008/4 "2018-01-25T10:28:48Z")

</div>

You still have the problem I pointed out in my previous message.

In filebeat.yml:

- Need to comment the `output.elasticsearch:` line.
- Need to uncomment the `output.logstash:` line.

Your config must look like:

```auto
#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch: # COMMENTED THIS LINE
  # Array of hosts to connect to.
  # hosts: ["localhost:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
output.logstash: # UNCOMMENTED THIS LINE
  # The Logstash hosts
  hosts: ["10.254.102.99:5044"]

```

---

<div class="post-metadata">

**Author:** ![ericchuhong](https://avatars.discourse-cdn.com/v4/letter/e/d78d45/32.png) [@ericchuhong](https://discuss.elastic.co/u/ericchuhong)\
**Post date:** [January 25, 2018, 11:02am UTC](https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008/5 "2018-01-25T11:02:06Z")

</div>

oh ~ Thank you very much.It works like a magic!!!!!!!

 ![IMG20180125_190126](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75e9f9d301db46c442de16ee434379d30c055c18.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2018, 11:02am UTC](https://discuss.elastic.co/t/why-file-always-get-this-error-it-makes-puzzle-two-day/117008/6 "2018-02-22T11:02:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.