Cannot see Filebeats - logstash data in Kibana

I have configured Filebeat to send data to logstash and logstash sends data to elasticsearch.

Nothing appears in logstash-* in kibana .. neither is there any data in filebeats-*.



  • input_type: log
    #- /var/log/*.log
    • D:\ELKWorkspace\ELK1.mule\logs\elk2.log
    • D:\ELK\logs\Poornima\CKServer.log
      exclude_lines: ["^DBG"]
      include_lines: ["^ERR", "^WARN", "^INFO"]


The Logstash hosts

hosts: ["localhost:5044"]


input {
beats {
port => 5044

output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"

Am not sure whether input port in logstash should be 5044 or 5043. Both do not work. However, Following are the console logs:



Based on your configuration, the data will be written to filebeat-YYYY.MM.DD indices. What does this query return?

curl http://localhost:9200/_cat/indices?v

@andrewkroh .. it returns ..

I have pasted the configuration of logstash and filebeat for reference ... do I need to alter/add something in it?

Further i think logstash is not sending the data received from filebeat to elasticsearch...

My issue is resolved.. in case someone is facing the same prob.

  1. In logstash.conf, remove

manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"

  1. In Filebeat, modify
    include_lines: ["^ERR", "^WARN", "^INFO"]
    include_lines: ["ERR", "WARN", "INFO"]

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.