Can't send logs from filebeats to logstash

[rajdeep101 (Rajdeep Singh)]

Filebeats wont let me exclude output.elasticsearch from filebeat.yml and would give and error "Exiting: Index management requested but the Elasticsearch output is not configured/enabled".

The setup runs without error when i comment out output.logstash but kibana doesnot register any logs. I am trying to test a sample log data (apache-access-logs) on my localhost. i am very new to all this.

Here i am attaching screenshots for my filebeat.yml file and logstash config files (input, filter and output).

[Antoine.E (Antoine Espinosa)]

Hello Rajdeep,

I think the problem with your filebeat.yml is that you are trying to manage shards number with the "setup.template.settings" and as you are not configuring an Elasticsearch output an error is popping up, could you try to comment this part of the configuration ?

Antoine

[payneb25827 (Brian)]

I have the same problem actually, and my config is simply:

filebeat.inputs:
- type: log
  paths:
    - c:\elk\logs\test.log

output.logstash:
  hosts: ["localhost:5044"]

[kumarabhi (Abhishek)]

@payneb25827 @rajdeep101
To keep things simple, it's better to just output the logstash to stdout. Below is the configuration for logstash.

input {
beats {
port => 5044
}
}

output {
  stdout { 
    codec => rubydebug { } 
  }
}

Filebeat config:

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

The elastic search output from filebeat should be disabled

#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

[rajdeep101 (Rajdeep Singh)]

Hi Antoine
I get the same error Exiting: Index management requested but the Elasticsearch output is not configured/enabled while running

Blockquote sudo filebeat setup

Although in kibana while adding log data from Add logs from logstash It shows data successfully imported. But i guess it is just importing the syslog data somehow as the logs Dashboard makes no sense and it is only capturing the elasticsearch and logstash logs.