ERROR instance/beat.go:1027 Exiting: 1 error: error loading config file: invalid config: yaml: line 85: did not find expected key Exiting: 1 error: error loading config file: invalid config: yaml: line 85: did not find expected key

[Rios]

So, at the end, did logs send and arrived to ES?

[yash2 (yash)]

No it did not sir.

[Rios]

Completely miss this topic. Sorry.
Do next:

1. Stop your Filebeat service if is running: systemctl status filebeat
2. All Filebeat processes should be stopped, use ps aux to check
3. Download https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.17.10-linux-x86_64.tar.gz or the latest, and extact somewhere, home or opt directory
4. Copy [Stephen config] + add logger, or just copy this as filebeat.yml (rename old) in the directory where is filebeat extracted, and pay attention on spaces at the begging of line

filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - /var/log/*.log

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1
 
setup.kibana:
  host: "localhost:5601"

#output.elasticsearch:
#  hosts: ["localhost:9200"]

output.console:
  pretty: true

logging.level: debug
logging.to_files: true
logging.files:
  path: ./logs
  name: filebeat.log
  keepfiles: 10
  permissions: 0644

5. Test config filebeat.yml in the extracted directory: ./filebeat.exe test config
6. Run it: ./filebeat.exe -e
7. You should see what's happening on the screen. You can delete the data/registry/filebeat/log.json file which keeps tracking and run it again without -e (Log to stderr and disable syslog/file output) to see only result
8. If everything is working, change output in filebeat.yml to elasticsearch.

[yash2 (yash)]

Hey, I have already tried all of this, filebeat, the configuration test, specifically, ./filebeat.exe -e, went through successfully, but filebeat is never outputting any logs to the dashboard, and instead been using logstash to send the logs to Elasticsearch, still, nothing works on that end, while enabling the Elasticsearch module from filebeat.

[Rios]

To see data in the dashboard, you have to import Kibana dashboard (filebeat setup -e) and configure module i.e. path to logs, port,...
Again it depend which FB module are you using and is that device/log/stream supported.

[yash2 (yash)]

I have done all of that

[yash2 (yash)]

We can close this.

[stephenb (Stephen Brown)]

@yash2 Did you find the solution?

If so can you please post so that anyone else that has the same issues might benefit?

Even if it is minor it help, or help us that answer so we might ask better questions next time.

Thanks