Sripal
(Sripal)
January 11, 2019, 5:35am
1
Dear All,
Please help me to solve this issue
Error
bash-4.2$ ./filebeat test config -c filebeat.yml
Config OK
bash-4.2$ ./filebeat
Exiting: Error in initing input: can not convert 'string' into 'bool' accessing 'filebeat.inputs.1.enabled' (source:'filebeat.yml')
bash-4.2$ ./filebeat test config -c filebeat.yml
Config OK
bash-4.2$
Filebeat.yml
filebeat.inputs:
#-------Each - is an input. Most options can be set at the input level, so
#-------you can use different inputs for various configurations.
#------- Below are the input specific configurations.
type: log
enabled: true
paths:
/app/IBM/HTTPServer/logs/access_log.2019*
fields:
log_type: accesslog
type: log
enabled: true
/app/IBM/HTTPServer/logs/error.log*
fields:
log_type: errorlog
#----------------------------- Logstash output --------------------------------
output.logstash:
#------- The Logstash hosts
hosts: ["x.x.x.x:5044"]
Sripal
(Sripal)
January 11, 2019, 5:39am
2
My log file names in the path:
Access Logs
access_log.2018-11-01-00_00_00
access_log.2018-11-01-00_45_00
access_log.2018-11-01-01_30_00 and so on...
Error Logs
errorlog.log.2018-07-02
errorlog.log.2018-07-09
errorlog.log.2018-07-11 and so on...
Kindly let me the config file is correct or not.
shaunak
(Shaunak Kashyap)
January 15, 2019, 3:51am
4
Sripal:
I changed my conf file
So is it working now? Or are you saying that it's not working even after you changed your config file? If it's not working, are you getting the same error as earlier or a different error?
Thanks,
Shaunak
Sripal
(Sripal)
January 18, 2019, 4:42am
5
Hi @shaunak ,
Sorry for the delay. I'm getting same error .
I'm using filebeat 6.4.2
There are the different yml files
filebeat.yml
filebeat-reference.yml
filed.yml
I want to read my access and error logs of webserver.
both logs are present in same directory "/app/server/logpath/logs"
I have created two LS config files to read the logs.
Kindly help me how to achieve this.
Sripal
(Sripal)
January 18, 2019, 4:56am
6
@shaunak
Currently i am reading only the access logs using the following configuration
filebeat.inputs:
-- type: log
paths:
- /app/server/logpath/logs/access_log.2019*
fields:
log_type: accesslog
#----------------------------- Logstash output --------------------------------
output.logstash:
#------ The Logstash hosts
hosts: ["172.16.19.50:5044"]
Sripal
(Sripal)
January 22, 2019, 5:22am
8
Hi All,
I changed my YML file
filebeat.prospectors:
paths:
/my/log/path/access_log.2019*
tags: [apache_access]
paths:
/my/log/path/error.log*
tags: [apache_error]
output.logstash:
hosts: ["172.16.19.50:5044"]
Sripal
(Sripal)
January 22, 2019, 5:23am
9
my pipeline.yml is
pipeline.id: test
pipeline.workers: 1
pipeline.batch.size: 1
config.string: "input { generator {} } filter { sleep { time => 1 } } output { stdout { codec => plain { format => '1' } } }"
pipeline.id: accesslog
pipeline.workers: 2
path.config: "/my/conf/file/path/apache_accesslog.conf"
pipeline.id: errorlog
pipeline.batch.size: 10000
path.config: "/my/conf/file/path/apache_errorlog.conf"
Sripal
(Sripal)
January 22, 2019, 5:27am
10
both conf files:
apache_accesslog.conf
apache_errorlog.conf
is working fine while running independently
Sripal
(Sripal)
January 22, 2019, 5:44am
11
my conf files are like
Accesslog.conf
input { beats { port => 5044 }}
filter { if "apache_access" in [tags] {
if[message] =~ /^[.*/ { grok {
output{elasticsearch{hosts => "10.10.10.10"index => "apache_access"
}
Errorlog.conf
input { beats { port => 5044 }}
filter { if "apache_error" in [tags] {
if[message] =~ /^[.*/ { grok { }
output{elasticsearch{hosts => "10.10.10.10"index => "apache_error"
}
Sripal
(Sripal)
January 22, 2019, 6:43am
12
my apache_error index contains the value of access logs.
Why error_log data not getting indexed?
system
(system)
Closed
February 19, 2019, 6:43am
13
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.