Eror : No indices match pattern "filebeat-*"

Elastic Stack Beats
1

No matching indices found: No indices match pattern "filebeat-*"

Hi , I want to get apache access.log but while adding filebeat index pattern show this error.

filebeat.yml file

1
1.png702×295 37.5 KB
2
2.png791×234 37.2 KB
3
3.png797×215 48.5 KB

tried other beats(metricbeat,packetbeat) they are working but filebeat not working ,

tried -paths : /var/log/apache2/access.log but again error.
Can you help me ? What is the problem

2
  • Have you enabled the apache module?
  • Have you setup templates, dashboards, etc. using ./filebeat setup?
  • Have you sent apache events to ES?

Next time please paste your configuration and format it using </>? Copy-pasting is much easier this way, if we want to test your configuration locally. :slight_smile:

3

I done it. But same result.
4 5

4

Could you please share your debug logs of Filebeat?

Please do not copy paste images with terminal output here. This makes investigating your issue much slower as we need to type the same thing you are sharing here. Which obviously takes more time than just copy-pasting what you have put here.

5

</>
Elasticsearch version 6.6.2
2019-03-22T15:33:32.823+0300 INFO template/load.go:130 Template already exists and will not be overwritten.
2019-03-22T15:33:32.823+0300 INFO instance/beat.go:894 Template successfully loaded.
2019-03-22T15:33:52.798+0300 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":60,"time":{"ms":2}},"total":{"ticks":150,"time":{"ms":22},"value":150},"user":{"ticks":90,"time":{"ms":20}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral_id":"49d52f66-9f11-4373-af13-ce64b3600434","uptime":{"ms":273014}},"memstats":{"gc_next":7325744,"memory_alloc":4185040,"memory_total":13851720,"rss":208896}},"filebeat":{"events":{"active":30,"added":30},"harvester":{"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"read":{"bytes":1080},"write":{"bytes":381}},"pipeline":{"clients":4,"events":{"active":203,"published":30,"retry":1,"total":30}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":0.07,"15":0.95,"5":0.29,"norm":{"1":0.0233,"15":0.3167,"5":0.0967}}}}}}
2019-03-22T15:34:22.797+0300 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":60},"total":{"ticks":160,"time":{"ms":16},"value":160},"user":{"ticks":100,"time":{"ms":16}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral_id":"49d52f66-9f11-4373-af13-ce64b3600434","uptime":{"ms":303015}},"memstats":{"gc_next":7325744,"memory_alloc":5401232,"memory_total":15067912,"rss":200704}},"filebeat":{"events":{"active":38,"added":38},"harvester":{"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":4,"events":{"active":241,"published":38,"total":38}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":0.04,"15":0.92,"5":0.26,"norm":{"1":0.0133,"15":0.3067,"5":0.0867}}}}}}
2019-03-22T15:34:29.983+0300 ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://10.10.10.6:9200)): Connection marked as failed because the onConnect callback failed: Error loading pipeline for fileset apache2/access: This module requires the following Elasticsearch plugins: ingest-user-agent, ingest-geoip. You can install them by running the following commands on all the Elasticsearch nodes:
sudo bin/elasticsearch-plugin install ingest-user-agent
sudo bin/elasticsearch-plugin install ingest-geoip
2019-03-22T15:34:29.983+0300 INFO pipeline/output.go:93 Attempting to reconnect to backoff(elasticsearch(http://10.10.10.6:9200)) with 8 reconnect attempt(s)
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:189 retryer: send unwait-signal to consumer
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:191 done
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:166 retryer: send wait signal to consumer
2019-03-22T15:34:29.983+0300 INFO [publish] pipeline/retry.go:168 done
2019-03-22T15:34:29.986+0300 INFO elasticsearch/client.go:721 Connected to Elasticsearch version 6.6.2
2019-03-22T15:34:29.989+0300 INFO template/load.go:130 Template already exists and will not be overwritten.
2019-03-22T15:34:29.989+0300 INFO instance/beat.go:894 Template successfully loaded.
2019-03-22T15:34:52.799+0300 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":70,"time":{"ms":9}},"total":{"ticks":190,"time":{"ms":20},"value":190},"user":{"ticks":120,"time":{"ms":11}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":11},"info":{"ephemeral_id":"49d52f66-9f11-4373-af13-ce64b3600434","uptime":{"ms":333014}},"memstats":{"gc_next":8308384,"memory_alloc":6649880,"memory_total":16316560,"rss":593920}},"filebeat":{"events":{"active":36,"added":36},"harvester":{"open_files":3,"running":3}},"libbeat":{"config":{"module":{"running":0}},"output":{"read":{"bytes":1080},"write":{"bytes":381}},"pipeline":{"clients":4,"events":{"active":277,"published":36,"retry":19,"total":36}}},"registrar":{"states":{"current":3}},"system":{"load":{"1":0.02,"15":0.89,"5":0.23,"norm":{"1":0.0067,"15":0.2967,"5":0.0767}}}}}}

</>

6

firstly i installed ingest-user-agent,ingest-geoip , after that install beat , but result same

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.