I have configured two filebeat inputs which the type of them is log.
filebeat.inputs:
- type: log
id: gateway-elk
enabled: true
paths:
- /home/ggg/app/ntp_gateway/gateway-elk.log
fields: {log_type: gatewaylog_analyzed}
- type: log
id: auralog_analyzed
enabled: true
paths:
- /home/ggg/app/ntp_bos/logs/elk.log
fields: {log_type: auralog_analyzed}
bulk_max_size: 4096
- add_id: ~
logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644
But when I start the service, though the service get started, in the server journal, following error message shows up.
Oct 16 14:47:38 ANBC-NTP-HA-SVR01 systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 filebeat[1353431]: Exiting: Failed to start crawler: starting input failed: error while initializing input: No paths were defined for input accessing 'filebeat.inputs.2' (source:'/etc/filebeat/filebeat.yml')
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Service RestartSec=100ms expired, scheduling restart.
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 194.
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Files that I have mentioned as inputs exist and logs are printed on them continuously as well. And also, those files have read permission for user, group and organization.
Can anyone please give me support on this?