Compiled Filebeat for rpi successfully but spool doesn't work

Elastic Stack Beats
1

I have successfully compiled Filebeat 6.6.2 for the RPI, filebeat works as expected but completely ignores settings spool settings to write to a file. The log shows filebeat working normally but contains no reference to why the spooling doesnt work. I've searched the whole filesystem for the spool.dat to no avail.

Can anyone point me in the right direction?

cheers

Zen

2

Can you share your config?

3 
   filebeat.inputs:

- type: log

  enabled: true
  paths:
    - /logs/*.csv


spool:
  file:
    path: "${path.data}/spool.dat"
    size: 500MiB
    page_size: 16KiB
    prealloc: true
  write:
    buffer_size: 1MiB
    flush.timeout: 5s
    flush.events: 100
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.1.100:5044"]

many thanks

4

The setting should be:

queue.spool:
 ...
5

thank you, that solved the problem!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.