Can't get filebeat to read filestream

Elastic Stack Beats
1

I'm trying to switch my filebeat "logs" streams to filestreams. I set up a really simple prospector file:

---
filebeat.inputs:
- type: filestream
  id: admintools
  paths:
    - '/home/geo/nba/6.3.5.1280/logs/admin-tools/admintools*.log'
  pipeline: nba_app_pipeline

However, filbeat can find the file, but doesn't find any filestream inputs:

2023-04-07T14:32:08.796-0500    DEBUG   [cfgfile]       cfgfile/cfgfile.go:193  Load config from file: /etc/filebeat/prospector-nba-apps.yml
2023-04-07T14:32:08.796-0500    DEBUG   [cfgfile]       cfgfile/reload.go:213   Number of module configs found: 0
2023-04-07T14:32:08.796-0500    DEBUG   [reload]        cfgfile/list.go:63      Starting reload procedure, current runners: 0

There is an admintools.log file there that has messages written to it every few seconds.

The filebeat.yml file has this setup:

filebeat.config.inputs:
  enabled: true
  path: "/etc/filebeat/prospector-*.yml"
  reload.enabled: true
  reload.period: "30s"

How can I debug this further?

2

Can you share your entire filebeat.yml?

Also, if you are loading external configurations from a folder, like the setting you shared, you need to remove the filebeat.inputs from the external configurations and the first line with ---, the file should start with -type: filestream, check the example in the documentation.

This:

---
filebeat.inputs:
- type: filestream
  id: admintools
  paths:
    - '/home/geo/nba/6.3.5.1280/logs/admin-tools/admintools*.log'
  pipeline: nba_app_pipeline

Should look like this in the prospector file:

- type: filestream
  id: admintools
  paths:
    - '/home/geo/nba/6.3.5.1280/logs/admin-tools/admintools*.log'
  pipeline: nba_app_pipeline
3

Thanks, the issue was that I repeated the "filebeat.inputs:" in the external declaration file. Once I removed it, filebeat was working with filestreams.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.