Kindly suggest me how to add the filebeats with the different index names?
As of now,I just added two clients, but I am able to view only logs of one client. Logs of filebeat of other client is also fine, its saying its transferring the logs. But on kibana i am unable to view the logs.
018-07-17T12:57:37.794+0530 INFO instance/beat.go:225 Setup Beat: filebeat; Version: 6.3.1
2018-07-17T12:57:37.795+0530 INFO pipeline/module.go:81 Beat name: shekhar-H81M-S
2018-07-17T12:57:37.929+0530 INFO instance/beat.go:315 filebeat start running.
2018-07-17T12:57:37.930+0530 INFO registrar/registrar.go:116 Loading registrar data from /var/lib/filebeat/registry
2018-07-17T12:57:37.930+0530 INFO registrar/registrar.go:127 States Loaded from registrar: 13
2018-07-17T12:57:37.930+0530 WARN beater/filebeat.go:354 Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2018-07-17T12:57:37.930+0530 INFO crawler/crawler.go:48 Loading Inputs: 1
2018-07-17T12:57:37.965+0530 INFO [monitoring] log/log.go:97 Starting metrics logging every 30s
2018-07-17T12:57:38.611+0530 INFO log/input.go:113 Configured paths: [/var/log/*.log]
2018-07-17T12:57:38.611+0530 INFO input/input.go:88 Starting input of type: log; ID: 11204088409762598069
2018-07-17T12:57:38.630+0530 INFO crawler/crawler.go:82 Loading and starting Inputs completed. Enabled inputs: 1
2018-07-17T12:57:38.630+0530 INFO cfgfile/reload.go:122 Config reloader started
2018-07-17T12:57:38.630+0530 INFO cfgfile/reload.go:214 Loading of config files completed.
filebeat test output
logstash: 192.168.2.230:5044...
connection...
parse host... OK
dns lookup... OK
addresses: 192.168.2.230
dial up... OK
TLS... WARN secure connection disabled
talk to server... OK
Couple of questions:
Are your two instances of filebeat running from the same host or separate hosts?
Which index names are you using? In your screenshot I see the default index name filebeat-{version}-{date} being used, and your Kibana is configured with the filebeat-* index pattern. If your second filebeat creates indices that don't match this pattern, it is normal that you won't see the events generated by it.
Actually I am new to this, I can't get the idea what you are saying!
Could you please suggest me of adding two different hosts into the Kibana? Please it's important & emergency.
You said you have 2 filebeat clients. Are they running on the same or on separate computers?
Please paste the configuration (filebeat.yml) of each individual filebeat. Enclose the configuration in triple backticks like this:
```
content of filebeat.yml
```
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.