Error: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch

Sorry to hear the issue is still there @Saber.Tala . Because filebeat is displaying errors that it does not know what files to watch, it leads me to believe that the error is in your filebeat.yml format.

Could you try modifying your filebeat.yml to match the default configuration?
It also looks like you have a typo "document_typ" instead of "document_type" and also, I believe document_type has been deprecated in Filebeat version 6.x and was used for the old filebeat.prospectors which have been replaced by inputs.
Please try to remove document_type, copy the same variables and order/formatting with dashes, so that "type" is at the top, "enabled" is below that, then "paths"

You can use this reference file to help, ctrl+f for "Filebeat inputs" to get to the input section:
https://www.elastic.co/guide/en/beats/filebeat/7.2/filebeat-reference-yml.html

Similar issue here: Filebeat file-god stopped and No modules or prospectors enabled and configuration reloading disabled

Hope this fixes the issue

2 Likes