Trying to troubleshoot issue with filebeat outputting to logstash. Determined it is a config issue, though cannot determine where the config issue lies. the filebeat.yml passes yaml lint, configtest, and is showing in debug logs that it is outputting events to logstash. It is however not getting to logstash server. Verified it's not a network issue by performing telnet to logstash node.
Putting my created config below. generated via Chef and Ruby, so just missing a nested field somewhere. if obvious let me know so I can adjust my generator method.
--- filebeat: prospectors: - paths: - "/var/log/audit/audit.log" - "/var/log/auth.log" - "/var/log/cron" - "/var/log/faillog" - "/var/log/httpd" - "/var/log/kern.log" - "/var/log/maillog" - "/var/log/messages" - "/var/log/mysqld.log" - "/var/log/secure" - "/var/log/sshd.log" - "/var/log/sudo/asu/*" - "/var/log/sudo/sudo.log" - "/var/log/yum.log" fields: ktopic: system index: jeff2 fwder: filebeat fields_under_root: true output: logstash: hosts: - logmgmt-dev.company.net:6785 worker: 1 logging: to_syslog: true to_files: true files: path: var/log/filebeat name: filebeat rotateeverybytes: 10485760 level: debug