title: Send logs with filebeat to logstash
body: <p>I'm trying to make filebeat send log to logstash on another machine and I just can't get it to work. This is the filebeat.yml configuration:</p>
  <p><a href="https://pastebin.com/8a2RtGBa" rel="nofollow noreferrer">https://pastebin.com/8a2RtGBa</a> (Using pastebin because of character limit)</p>
  <p>This is the configuration on the machine that has logstash:</p>
  <pre><code>[root@ELK ~]$ cat /etc/logstash/conf.d/testing.conf 
  input{
  file{
  path =&gt; &quot;/var/log/commands.log&quot;
  }
  beats{
  port =&gt; 5044
  }
  }
  filter {
  if [path] == &quot;/var/log/commands.log&quot; {
  grok{
  match =&gt; { &quot;message&quot; =&gt; &quot;\[(%{TIMESTAMP_ISO8601:sys_timestamp})\]\s(?&lt;field1&gt;[0-9a-zA-Z_-]+)\s(?&lt;field2&gt;[0-9a-zA-Z_-]+)\:USER=(?&lt;field3&gt;[0-9a-zA-Z_-]+)\sPWD=(?&lt;field4&gt;[0-9a-zA-Z_/-]+)\sPID=\[(?&lt;field5&gt;[0-9]+)\]\sCMD=\&quot;(?&lt;field6&gt;.*)\&quot;\sExit=\[(?&lt;field7&gt;[0-9]+)\]\sCONNECTION=(?&lt;field8&gt;.*)&quot;
  }
  }
  }
  }
  output{
  elasticsearch { hosts =&gt; [&quot;localhost:9200&quot;]}
  }
  </code></pre>
  <p>This is what I get if I try setting filebeat with &quot;filebeat setup -e&quot;:</p>
  <pre><code>[root@server150 ~]# filebeat setup -e
  2020-07-17T08:12:36.199Z        INFO    instance/beat.go:647    Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
  2020-07-17T08:12:36.200Z        INFO    instance/beat.go:655    Beat ID: aa84fd5b-d016-4688-a4a1-172dbcf2054a
  2020-07-17T08:12:36.202Z        INFO    [beat]  instance/beat.go:983    Beat info       {&quot;system_info&quot;: {&quot;beat&quot;: {&quot;path&quot;: {&quot;config&quot;: &quot;/etc/filebeat&quot;, &quot;data&quot;: &quot;/var/lib/filebeat&quot;, &quot;home&quot;: &quot;/usr/share/filebeat&quot;, &quot;logs&quot;: &quot;/var/log/filebeat&quot;}, &quot;type&quot;: &quot;filebeat&quot;, &quot;uuid&quot;: &quot;aa84fd5b-d016-4688-a4a1-172dbcf2054a&quot;}}}
  2020-07-17T08:12:36.203Z        INFO    [beat]  instance/beat.go:992    Build info      {&quot;system_info&quot;: {&quot;build&quot;: {&quot;commit&quot;: &quot;f79387d32717d79f689d94fda1ec80b2cf285d30&quot;, &quot;libbeat&quot;: &quot;7.8.0&quot;, &quot;time&quot;: &quot;2020-06-14T18:15:37.000Z&quot;, &quot;version&quot;: &quot;7.8.0&quot;}}}
  2020-07-17T08:12:36.203Z        INFO    [beat]  instance/beat.go:995    Go runtime info {&quot;system_info&quot;: {&quot;go&quot;: {&quot;os&quot;:&quot;linux&quot;,&quot;arch&quot;:&quot;amd64&quot;,&quot;max_procs&quot;:4,&quot;version&quot;:&quot;go1.13.10&quot;}}}
  2020-07-17T08:12:36.204Z        INFO    [beat]  instance/beat.go:999    Host info       {&quot;system_info&quot;: {&quot;host&quot;: {&quot;architecture&quot;:&quot;x86_64&quot;,&quot;boot_time&quot;:&quot;2020-07-09T11:44:16Z&quot;,&quot;containerized&quot;:false,&quot;name&quot;:&quot;server150&quot;,&quot;ip&quot;:[&quot;127.0.0.1/8&quot;,&quot;*ip-of-thismachine*/25&quot;],&quot;kernel_version&quot;:&quot;3.10.0-1062.18.1.el7.x86_64&quot;,&quot;mac&quot;:[&quot;00:0c:29:e5:a1:fa&quot;],&quot;os&quot;:{&quot;family&quot;:&quot;redhat&quot;,&quot;platform&quot;:&quot;centos&quot;,&quot;name&quot;:&quot;CentOS Linux&quot;,&quot;version&quot;:&quot;7 (Core)&quot;,&quot;major&quot;:7,&quot;minor&quot;:8,&quot;patch&quot;:2003,&quot;codename&quot;:&quot;Core&quot;},&quot;timezone&quot;:&quot;UTC&quot;,&quot;timezone_offset_sec&quot;:0,&quot;id&quot;:&quot;3eec437c66d444a59ef5f075a429441d&quot;}}}
  2020-07-17T08:12:36.204Z        INFO    [beat]  instance/beat.go:1028   Process info    {&quot;system_info&quot;: {&quot;process&quot;: {&quot;capabilities&quot;: {&quot;inheritable&quot;:null,&quot;permitted&quot;:[&quot;chown&quot;,&quot;dac_override&quot;,&quot;dac_read_search&quot;,&quot;fowner&quot;,&quot;fsetid&quot;,&quot;kill&quot;,&quot;setgid&quot;,&quot;setuid&quot;,&quot;setpcap&quot;,&quot;linux_immutable&quot;,&quot;net_bind_service&quot;,&quot;net_broadcast&quot;,&quot;net_admin&quot;,&quot;net_raw&quot;,&quot;ipc_lock&quot;,&quot;ipc_owner&quot;,&quot;sys_module&quot;,&quot;sys_rawio&quot;,&quot;sys_chroot&quot;,&quot;sys_ptrace&quot;,&quot;sys_pacct&quot;,&quot;sys_admin&quot;,&quot;sys_boot&quot;,&quot;sys_nice&quot;,&quot;sys_resource&quot;,&quot;sys_time&quot;,&quot;sys_tty_config&quot;,&quot;mknod&quot;,&quot;lease&quot;,&quot;audit_write&quot;,&quot;audit_control&quot;,&quot;setfcap&quot;,&quot;mac_override&quot;,&quot;mac_admin&quot;,&quot;syslog&quot;,&quot;wake_alarm&quot;,&quot;block_suspend&quot;],&quot;effective&quot;:[&quot;chown&quot;,&quot;dac_override&quot;,&quot;dac_read_search&quot;,&quot;fowner&quot;,&quot;fsetid&quot;,&quot;kill&quot;,&quot;setgid&quot;,&quot;setuid&quot;,&quot;setpcap&quot;,&quot;linux_immutable&quot;,&quot;net_bind_service&quot;,&quot;net_broadcast&quot;,&quot;net_admin&quot;,&quot;net_raw&quot;,&quot;ipc_lock&quot;,&quot;ipc_owner&quot;,&quot;sys_module&quot;,&quot;sys_rawio&quot;,&quot;sys_chroot&quot;,&quot;sys_ptrace&quot;,&quot;sys_pacct&quot;,&quot;sys_admin&quot;,&quot;sys_boot&quot;,&quot;sys_nice&quot;,&quot;sys_resource&quot;,&quot;sys_time&quot;,&quot;sys_tty_config&quot;,&quot;mknod&quot;,&quot;lease&quot;,&quot;audit_write&quot;,&quot;audit_control&quot;,&quot;setfcap&quot;,&quot;mac_override&quot;,&quot;mac_admin&quot;,&quot;syslog&quot;,&quot;wake_alarm&quot;,&quot;block_suspend&quot;],&quot;bounding&quot;:[&quot;chown&quot;,&quot;dac_override&quot;,&quot;dac_read_search&quot;,&quot;fowner&quot;,&quot;fsetid&quot;,&quot;kill&quot;,&quot;setgid&quot;,&quot;setuid&quot;,&quot;setpcap&quot;,&quot;linux_immutable&quot;,&quot;net_bind_service&quot;,&quot;net_broadcast&quot;,&quot;net_admin&quot;,&quot;net_raw&quot;,&quot;ipc_lock&quot;,&quot;ipc_owner&quot;,&quot;sys_module&quot;,&quot;sys_rawio&quot;,&quot;sys_chroot&quot;,&quot;sys_ptrace&quot;,&quot;sys_pacct&quot;,&quot;sys_admin&quot;,&quot;sys_boot&quot;,&quot;sys_nice&quot;,&quot;sys_resource&quot;,&quot;sys_time&quot;,&quot;sys_tty_config&quot;,&quot;mknod&quot;,&quot;lease&quot;,&quot;audit_write&quot;,&quot;audit_control&quot;,&quot;setfcap&quot;,&quot;mac_override&quot;,&quot;mac_admin&quot;,&quot;syslog&quot;,&quot;wake_alarm&quot;,&quot;block_suspend&quot;],&quot;ambient&quot;:null}, &quot;cwd&quot;: &quot;/root&quot;, &quot;exe&quot;: &quot;/usr/share/filebeat/bin/filebeat&quot;, &quot;name&quot;: &quot;filebeat&quot;, &quot;pid&quot;: 12559, &quot;ppid&quot;: 11800, &quot;seccomp&quot;: {&quot;mode&quot;:&quot;disabled&quot;,&quot;no_new_privs&quot;:false}, &quot;start_time&quot;: &quot;2020-07-17T08:12:35.340Z&quot;}}}
  2020-07-17T08:12:36.204Z        INFO    instance/beat.go:310    Setup Beat: filebeat; Version: 7.8.0
  2020-07-17T08:12:36.205Z        INFO    [publisher]     pipeline/module.go:113  Beat name: server150
  2020-07-17T08:12:36.206Z        WARN    beater/filebeat.go:156  Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
  2020-07-17T08:12:36.206Z        ERROR   instance/beat.go:958    Exiting: Index management requested but the Elasticsearch output is not configured/enabled
  Exiting: Index management requested but the Elasticsearch output is not configured/enabled
  </code></pre>
  <p>This is what I get when I try to run filebeat with &quot;filebeat -e&quot;:</p>
  <pre><code>[root@server150 ~]# filebeat -e
  2020-07-17T08:16:47.104Z        INFO    instance/beat.go:647    Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
  2020-07-17T08:16:47.104Z        INFO    instance/beat.go:655    Beat ID: aa84fd5b-d016-4688-a4a1-172dbcf2054a
  2020-07-17T08:16:47.107Z        INFO    instance/beat.go:404    filebeat stopped.
  2020-07-17T08:16:47.107Z        ERROR   instance/beat.go:958    Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
  Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
  </code></pre>
  <p>Does anyone knows what's going on? I just can't get it to work. Huge thanks ahead!</p>