Failed to excute logstash

Elastic Stack Logstash
1 
 Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, 
 :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any input 
 plugin named 'filebeat'. Are you sure this is correct? Trying to load the filebeat input 
 plugin resulted in this error: no such file to load -- logstash/inputs/filebeat", 
:backtrace=>["/usr/share/logstash/logstash- 
core/lib/logstash/plugins/registry.rb:211:in `lookup_pipeline_plugin'", 
"/usr/share/logstash/logstash-core/lib/logstash/plugin.rb:137:in `lookup'", 
"org/logstash/plugins/PluginFactoryExt.java:222:in `plugin'", 
"org/logstash/plugins/PluginFactoryExt.java:181:in `plugin'", 
 "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:71:in `plugin'", " 
  (eval):8:in 
 `<eval>'", "org/jruby/RubyKernel.java:994:in `eval'", "/usr/share/logstash/logstash- 
   core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash- 
  core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash- 
   core/lib/logstash/pipeline_action/create.rb:43:in `block in execute'", 
 "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in `block in exclusive'", 
"org/jruby/ext/thread/Mutex.java:148:in `synchronize'", 
"/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in `exclusive'", 
 "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:39:in 
`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:327:in `block in 
 converge_state'"]}
2

Hi @Youssef_SBAI - There is no input plugin named filebeat in the list of Logstash input plugins available. Did you mean to use the beats input plugin?

3

Thank you i use the beats input but i have this error

 NFO [monitoring]	log/log.go:145	Non-zero metrics in the last 30s	 
{"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":140,"time": 
{"ms":2}},"total":{"ticks":570,"time":{"ms":10},"value":570},"user":{"ticks":430,"time": 
{"ms":8}}},"handles":{"limit":{"hard":1048576,"soft":1048576},"open":5},"info": 
{"ephemeral_id":"25ac1579-593f-48c1-8bf5-4c689b5437f9","uptime": 
{"ms":1350049}},"memstats": 
{"gc_next":7435872,"memory_alloc":3726160,"memory_total":23899080},"runtime": 
{"goroutines":15}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat": 
{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events": 
{"active":0}}},"registrar":{"states":{"current":0}},"system":{"load": 
{"1":0.45,"15":0.59,"5":0.54,"norm":{"1":0.1125,"15":0.1475,"5":0.135}}}}}}
4

It's not an error. It is simply telling you that it's not receiveing anything. You sure that filebeat is sending data to LS?

5

These are the monitoring logs/metrics from Filebeat - there are not error messages. I can see that no files are being harvested by Filebeat (hence no events sent to Logstash). I suggest you review your Filebeat configuration. If you need further assistance, let us know.

6

I use this config for filebeat:

filebeat.prospectors:
 - input_type: log
 enabled: true

 paths:
-  /data/volumes/monitoring/logstash/logCtrlM/GM_NY040_JOBS-PLAN-COURANT_7J_A070320_20200307100100.csv  
 output.logstash:
 hosts: ["logstash:5044"]
7

@Youssef_SBAI - Can you run Filebeat with debug logging enabled and share the debug logs? For example, you can run filebeat -e -d "*".

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.