Custom Logs via elastic agent on ECK

Elastic Observability
1

Hello,

I am trying to view custom logs on elastic cloud on kubernetes using an elastic agent. This is my configuration and I cannot view data on elasticsearch. Elasticsearch and Kibana are running normally and I get metricbeat and filebeat metrics and logs via this elastic agent:

apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
name: elastic-agent
spec:
version: 8.7.0
elasticsearchRefs:

  • name: elasticsearch
    daemonSet:
    podTemplate:
    spec:
    securityContext:
    runAsUser: 0
    config:
    inputs:
    • name: log
      version: latest
      type: logfile
      enabled: true
      use_output: default
      meta:
      package:
      name: switch-log
      version: latest
      data_stream:
      streams:
      data_stream:
      dataset: sw02.log
      type: logs
      paths:
      • /home/pi/swlog/sw02.log*
2

Hi Nada,

Are you seeing any errors in the logs at all?

3

Hello Carly, I am seeing normal logs from filestream but not from this specific logfile I had specified.

4

Thanks for confirming. When you run the setup command did you see any errors for this file? Have you also checked the file permissions of this logfile to ensure the beat can access the file?

1 Like