Hi, I'm a newbie. Trying to use filebeat version 7.13.1, I've enabled two modules system and oracle like so: ./filebeat modules enable system oracle. I'm not changing either the system.yml or oracle.yml config files. I have in filebeat.yml:
< filebeat.inputs:
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: false
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/*.log
- type: log
enabled: true
paths:
- /var/log/secure
- type: log
enabled: true
paths:
- /app/oracle/admin/XXXXX/adump/*.aud
And the output set as:
# ------------------------------ Logstash Output -------------------------------
output.logstash:
# The Logstash hosts
hosts: ["xxxxx-x-xxxxx.xxx.xx:5044"]
When I run it I'm getting the following error messages:
2021-06-09T16:36:51.594+0100 INFO [monitoring] log/log.go:153 Uptime: 3.0477377s
2021-06-09T16:36:51.594+0100 INFO [monitoring] log/log.go:130 Stopping metrics logging.
2021-06-09T16:36:51.594+0100 INFO instance/beat.go:479 filebeat stopped.
2021-06-09T16:36:51.594+0100 ERROR instance/beat.go:989 Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: error getting config for fileset oracle/database_audit: Error interpreting the template of the input: template: text:3:22: executing "text" at <.paths>: range can't iterate over /app/oracle/admin/XXXX/adump/*.aud
Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: error getting config for fileset oracle/database_audit: Error interpreting the template of the input: template: text:3:22: executing "text" at <.paths>: range can't iterate over /app/oracle/admin/XXXX/adump/*.aud
It work as expected if I only use the system module and input, but not when I try and use the oracle one. Any suggestions please?