Error in initing input Filebeat


(Sripal) #1

Dear All,

Please help me to solve this issue

Error

bash-4.2$ ./filebeat test config -c filebeat.yml
Config OK
bash-4.2$ ./filebeat
Exiting: Error in initing input: can not convert 'string' into 'bool' accessing 'filebeat.inputs.1.enabled' (source:'filebeat.yml')
bash-4.2$ ./filebeat test config -c filebeat.yml
Config OK
bash-4.2$

Filebeat.yml

filebeat.inputs:

#-------Each - is an input. Most options can be set at the input level, so
#-------you can use different inputs for various configurations.
#------- Below are the input specific configurations.

  • type: log
    enabled: true
    paths:
    • /app/IBM/HTTPServer/logs/access_log.2019*
      fields:
      log_type: accesslog
  • type: log
    enabled: true
    • /app/IBM/HTTPServer/logs/error.log*
      fields:
      log_type: errorlog
      #----------------------------- Logstash output --------------------------------
      output.logstash:
      #------- The Logstash hosts
      hosts: ["x.x.x.x:5044"]

(Sripal) #2

My log file names in the path:

Access Logs

  1. access_log.2018-11-01-00_00_00
  2. access_log.2018-11-01-00_45_00
  3. access_log.2018-11-01-01_30_00 and so on...

Error Logs

  1. errorlog.log.2018-07-02
  2. errorlog.log.2018-07-09
  3. errorlog.log.2018-07-11 and so on...

Kindly let me the config file is correct or not.


(Sripal) #3

I changed my conf file

filebeat.inputs:

  • type: accesslog

    paths:

    • /app/IBM/HTTPServer/logs/access_log.2019*
      fields:
      log_type: accesslog
  • type: errorlog

    • /app/IBM/HTTPServer/logs/error.log.2019*
      fields:
      log_type: errorlog

(Shaunak Kashyap) #4

So is it working now? Or are you saying that it's not working even after you changed your config file? If it's not working, are you getting the same error as earlier or a different error?

Thanks,

Shaunak


(Sripal) #5

Hi @shaunak,

Sorry for the delay. I'm getting same error .

I'm using filebeat 6.4.2
There are the different yml files

  1. filebeat.yml
  2. filebeat-reference.yml
  3. filed.yml

I want to read my access and error logs of webserver.
both logs are present in same directory "/app/server/logpath/logs"

I have created two LS config files to read the logs.
Kindly help me how to achieve this.


(Sripal) #6

@shaunak

Currently i am reading only the access logs using the following configuration
filebeat.inputs:

-- type: log

paths:
- /app/server/logpath/logs/access_log.2019*
fields:
log_type: accesslog

#----------------------------- Logstash output --------------------------------
output.logstash:
#------ The Logstash hosts
hosts: ["172.16.19.50:5044"]


(Sripal) #7

HI @shaunak,

Could you please help


(Sripal) #8

Hi All,

I changed my YML file

filebeat.prospectors:

  • paths:
    • /my/log/path/access_log.2019*
      tags: [apache_access]
  • paths:
    • /my/log/path/error.log*
      tags: [apache_error]

output.logstash:
hosts: ["172.16.19.50:5044"]


(Sripal) #9

my pipeline.yml is

pipeline.id: test
pipeline.workers: 1
pipeline.batch.size: 1
config.string: "input { generator {} } filter { sleep { time => 1 } } output { stdout { codec => plain { format => '1' } } }"

  • pipeline.id: accesslog
    pipeline.workers: 2
    path.config: "/my/conf/file/path/apache_accesslog.conf"
  • pipeline.id: errorlog
    pipeline.batch.size: 10000
    path.config: "/my/conf/file/path/apache_errorlog.conf"

(Sripal) #10

both conf files:

  1. apache_accesslog.conf
  2. apache_errorlog.conf

is working fine while running independently


(Sripal) #11

my conf files are like

Accesslog.conf
input { beats { port => 5044 }}
filter { if "apache_access" in [tags] {
if[message] =~ /^[.*/ { grok {
output{elasticsearch{hosts => "10.10.10.10"index => "apache_access"
}

Errorlog.conf
input { beats { port => 5044 }}
filter { if "apache_error" in [tags] {
if[message] =~ /^[.*/ { grok { }
output{elasticsearch{hosts => "10.10.10.10"index => "apache_error"
}


(Sripal) #12

my apache_error index contains the value of access logs.

Why error_log data not getting indexed?


(system) closed #13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.