Got following error when tried to start Filebeat service:
[root@VM1 filebeat]# systemctl start filebeat
Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?
**Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch**
[root@VM1 filebeat]# less /etc/filebeat/filebeat.yml
filebeat:
paths:
- /var/log/secure
- /var/log/messages
# - /var/log/*.log
type: log
enabled: true
document_typ: syslog
output:
logstash:
hosts: ["172.27.95.196:5044"]
bulk_max_size: 1024
tls:
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
shipper:
logging:
files:
rotateeverybytes: 10485760 # = 10MB
[root@VM1 filebeat]# less /etc/filebeat/filebeat.reference.yml
#========================== Modules configuration =============================
filebeat.modules:
#-------------------------------- System Module --------------------------------
- module: system
# Syslog
syslog:
enabled: true
I have installed Filebeat version 7.2.0 on a Red-Hat 7 box and can reach to the port 5044 of logstash.
On ELK server, I have installed Logstash (7.1.1), ElasticSearch(7.1.1) and Kibana and they are all listening on default ports.
I found the following error on /var/log/filebeat
ERROR instance/beat.go:877 Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?