Activemq module give Grok error on filebeat

Elastic Stack Beats
1

Hello all,

Running in k8s I have activemq and filebeat, elasticsearch, kibana.
filebeat collect the logs from activemq like so:

      filebeat.autodiscover:
        providers:
          - type: kubernetes
            hints.enabled: true
            templates:
              - condition:
                  contains:
                    kubernetes.pod.name: activemq
                config:
                  - module: activemq
                    log:
                      enabled: true
                      input:
                        type: container
                        containers.ids:
                          - "${data.kubernetes.container.id}"
                        paths:
                          - /var/log/containers/*${data.kubernetes.container.id}.log

And send it directly to elastic.

I get error.message Provided Grok expressions do not match field value.

Anyone see what am I doing wrong?

The logs:

INFO  | main | Initial proxy whitelist: [localhost, 127.0.0.1, 172.17.0.6, activemq-0.activemq.default.svc.cluster.local]
 INFO | No Spring WebApplicationInitializer types detected on classpath
 INFO | ActiveMQ WebConsole available at http://0.0.0.0:8161/
 INFO | ActiveMQ Jolokia REST API available at http://0.0.0.0:8161/api/jolokia/
...
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.