Error No matching indices found: No indices match pattern "filebeat-*"


(Vitaly) #1

Filebeat not creating an index. Any ideas?

_cat/indices

filebeat.yml

###################### Filebeat Configuration Example #########################

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- type: log

  # Change to true to enable this prospector configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*

  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  #exclude_lines: ['^DBG']

  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  #include_lines: ['^ERR', '^WARN']

  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  #exclude_files: ['.gz$']

  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  #fields:
  #  level: debug
  #  review: 1



#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: true

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 3
  #index.codec: best_compression
  #_source.enabled: false

#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#fields:
#  env: staging


#============================== Dashboards =====================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here, or by using the `-setup` CLI flag or the `setup` command.
#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: "localhost:5601"

#============================= Elastic Cloud ==================================

# These settings simplify using filebeat with the Elastic Cloud (https://cloud.elastic.co/).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:

#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  username: "elastic"
  password: "password"

#----------------------------- Logstash output --------------------------------
#output.logstash:
  # The Logstash hosts
  #hosts: ["localhost:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]

#============================== Xpack Monitoring ===============================
# filebeat can export internal metrics to a central Elasticsearch monitoring
# cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The
# reporting is disabled by default.

# Set to true to enable the monitoring reporter.
#xpack.monitoring.enabled: false

# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well. Any setting that is not set is
# automatically inherited from the Elasticsearch output configuration, so if you
# have the Elasticsearch output configured, you can simply uncomment the
# following line.
#xpack.monitoring.elasticsearch:

All dashboards are loaded. Metricbeat working fine if it matters.


(Vitaly) #2

/var/log/filebeat

2018-05-30T04:19:35.388Z INFO elasticsearch/client.go:145 Elasticsearch url: http://localhost:9200
2018-05-30T04:19:35.388Z INFO pipeline/module.go:76 Beat name: ubuntu-512mb-fra1-01
2018-05-30T04:19:35.389Z INFO [monitoring] log/log.go:97 Starting metrics logging every 30s
2018-05-30T04:19:35.389Z INFO instance/beat.go:301 filebeat start running.
2018-05-30T04:19:35.389Z INFO registrar/registrar.go:110 Loading registrar data from /var/lib/filebeat/registry
2018-05-30T04:19:35.389Z INFO registrar/registrar.go:121 States Loaded from registrar: 8
2018-05-30T04:19:35.389Z INFO crawler/crawler.go:48 Loading Prospectors: 1
2018-05-30T04:19:35.389Z WARN [cfgwarn] cfgfile/reload.go:77 BETA: Dynamic config reload is enabled.
2018-05-30T04:19:35.389Z INFO crawler/crawler.go:82 Loading and starting Prospectors completed. Enabled prospectors: 0
2018-05-30T04:19:35.389Z INFO cfgfile/reload.go:127 Config reloader started
2018-05-30T04:20:05.391Z INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":0,"time":8},"total":{"ticks":10,"time":20,"value":10},"user":{"ticks":10,"time":12}},"info":{"ephemeral_id":"b455fc8e-342b-4fd7-86e3-e50f059444b8","uptime":{"ms":30009}},"memstats":{"gc_next":4473924,"memory_alloc":2837968,"memory_total":2837968,"rss":20598784}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0},"reloads":2},"output":{"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"cpu":{"cores":4},"load":{"1":3.69,"15":3.18,"5":3.41,"norm":{"1":0.9225,"15":0.795,"5":0.8525}}}}}}


(Harsh Bajaj) #3

Hi @cro

I've checked your config file and found that you didn't set below parameter to true as this will enable the prospector configuration and in logs also showing '0' prospector enabled.

YML file:

Logs:

Solution:
Please set this parameter as true and restart the service and let me know if you are still getting this error.

Regards,


(Vitaly) #4

@harshbajaj16 Yes, it helped, thank you! I noticed that there are No results found in the filebeat metrics. Is that ok? Will data appear later or must it happen immediately?

2018-06-01T15:53:52.230Z INFO pipeline/module.go:76 Beat name: ubuntu-512mb-fra1-01
2018-06-01T15:53:52.230Z INFO instance/beat.go:301 filebeat start running.
2018-06-01T15:53:52.230Z INFO registrar/registrar.go:110 Loading registrar data from /var/lib/filebeat/registry
2018-06-01T15:53:52.231Z INFO registrar/registrar.go:121 States Loaded from registrar: 14
2018-06-01T15:53:52.231Z INFO crawler/crawler.go:48 Loading Prospectors: 1
2018-06-01T15:53:52.231Z INFO [monitoring] log/log.go:97 Starting metrics logging every 30s
2018-06-01T15:53:52.256Z INFO log/prospector.go:111 Configured paths: [/var/log/*.log]
2018-06-01T15:53:52.256Z WARN [cfgwarn] cfgfile/reload.go:77 BETA: Dynamic config reload is enabled.
2018-06-01T15:53:52.256Z INFO crawler/crawler.go:82 Loading and starting Prospectors completed. Enabled prospectors: 1
2018-06-01T15:53:52.256Z INFO cfgfile/reload.go:127 Config reloader started
2018-06-01T15:54:22.233Z INFO [monitoring] log/log.go:124 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":0,"time":8},"total":{"ticks":10,"time":24,"value":10},"user":{"ticks":10,"time":16}},"info":{"ephemeral_id":"52c23fa7-acee-4b4c-80fc-f4f601183aea","uptime":{"ms":30009}},"memstats":{"gc_next":4473924,"memory_alloc":2977296,"memory_total":2977296,"rss":21299200}},"filebeat":{"events":{"added":7,"done":7},"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0},"reloads":2},"output":{"type":"elasticsearch"},"pipeline":{"clients":1,"events":{"active":0,"filtered":7,"total":7}}},"registrar":{"states":{"current":14,"update":7},"writes":7},"system":{"cpu":{"cores":4},"load":{"1":3.06,"15":3.04,"5":2.96,"norm":{"1":0.765,"15":0.76,"5":0.74}}}}}}


(Harsh Bajaj) #5

Hi,

It will show the metrics in your filebeat logs once your log files harvested.

Please check once again and let me know if you are facing any issue.

Regards,


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.