Error in initing input Filebeat

Dear All,

Please help me to solve this issue

Error

bash-4.2$ ./filebeat test config -c filebeat.yml
Config OK
bash-4.2$ ./filebeat
Exiting: Error in initing input: can not convert 'string' into 'bool' accessing 'filebeat.inputs.1.enabled' (source:'filebeat.yml')
bash-4.2$ ./filebeat test config -c filebeat.yml
Config OK
bash-4.2$

Filebeat.yml

filebeat.inputs:

#-------Each - is an input. Most options can be set at the input level, so
#-------you can use different inputs for various configurations.
#------- Below are the input specific configurations.

  • type: log
    enabled: true
    paths:
    • /app/IBM/HTTPServer/logs/access_log.2019*
      fields:
      log_type: accesslog
  • type: log
    enabled: true
    • /app/IBM/HTTPServer/logs/error.log*
      fields:
      log_type: errorlog
      #----------------------------- Logstash output --------------------------------
      output.logstash:
      #------- The Logstash hosts
      hosts: ["x.x.x.x:5044"]

My log file names in the path:

Access Logs

  1. access_log.2018-11-01-00_00_00
  2. access_log.2018-11-01-00_45_00
  3. access_log.2018-11-01-01_30_00 and so on...

Error Logs

  1. errorlog.log.2018-07-02
  2. errorlog.log.2018-07-09
  3. errorlog.log.2018-07-11 and so on...

Kindly let me the config file is correct or not.

I changed my conf file

filebeat.inputs:

  • type: accesslog

    paths:

    • /app/IBM/HTTPServer/logs/access_log.2019*
      fields:
      log_type: accesslog
  • type: errorlog

    • /app/IBM/HTTPServer/logs/error.log.2019*
      fields:
      log_type: errorlog

So is it working now? Or are you saying that it's not working even after you changed your config file? If it's not working, are you getting the same error as earlier or a different error?

Thanks,

Shaunak

Hi @shaunak,

Sorry for the delay. I'm getting same error .

I'm using filebeat 6.4.2
There are the different yml files

  1. filebeat.yml
  2. filebeat-reference.yml
  3. filed.yml

I want to read my access and error logs of webserver.
both logs are present in same directory "/app/server/logpath/logs"

I have created two LS config files to read the logs.
Kindly help me how to achieve this.

@shaunak

Currently i am reading only the access logs using the following configuration
filebeat.inputs:

-- type: log

paths:
- /app/server/logpath/logs/access_log.2019*
fields:
log_type: accesslog

#----------------------------- Logstash output --------------------------------
output.logstash:
#------ The Logstash hosts
hosts: ["172.16.19.50:5044"]

HI @shaunak,

Could you please help

Hi All,

I changed my YML file

filebeat.prospectors:

  • paths:
    • /my/log/path/access_log.2019*
      tags: [apache_access]
  • paths:
    • /my/log/path/error.log*
      tags: [apache_error]

output.logstash:
hosts: ["172.16.19.50:5044"]

my pipeline.yml is

pipeline.id: test
pipeline.workers: 1
pipeline.batch.size: 1
config.string: "input { generator {} } filter { sleep { time => 1 } } output { stdout { codec => plain { format => '1' } } }"

  • pipeline.id: accesslog
    pipeline.workers: 2
    path.config: "/my/conf/file/path/apache_accesslog.conf"
  • pipeline.id: errorlog
    pipeline.batch.size: 10000
    path.config: "/my/conf/file/path/apache_errorlog.conf"

both conf files:

  1. apache_accesslog.conf
  2. apache_errorlog.conf

is working fine while running independently

my conf files are like

Accesslog.conf
input { beats { port => 5044 }}
filter { if "apache_access" in [tags] {
if[message] =~ /^[.*/ { grok {
output{elasticsearch{hosts => "10.10.10.10"index => "apache_access"
}

Errorlog.conf
input { beats { port => 5044 }}
filter { if "apache_error" in [tags] {
if[message] =~ /^[.*/ { grok { }
output{elasticsearch{hosts => "10.10.10.10"index => "apache_error"
}

my apache_error index contains the value of access logs.

Why error_log data not getting indexed?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.