Failed to start crawler: starting input failed: error while initializing input: No paths were defined for input accessing

Elastic Stack Beats
1

I have configured two filebeat inputs which the type of them is log.

filebeat.inputs:
- type: log
  id: gateway-elk
  enabled: true
  paths:
    - /home/ggg/app/ntp_gateway/gateway-elk.log

  fields: {log_type: gatewaylog_analyzed}

- type: log
  id: auralog_analyzed
  enabled: true
  paths:
    - /home/ggg/app/ntp_bos/logs/elk.log

  fields: {log_type: auralog_analyzed}
  
  bulk_max_size: 4096

- add_id: ~

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

But when I start the service, though the service get started, in the server journal, following error message shows up.

Oct 16 14:47:38 ANBC-NTP-HA-SVR01 systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 filebeat[1353431]: Exiting: Failed to start crawler: starting input failed: error while initializing input: No paths were defined for input accessing 'filebeat.inputs.2' (source:'/etc/filebeat/filebeat.yml')
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Service RestartSec=100ms expired, scheduling restart.
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 194.
Oct 16 14:47:42 ANBC-NTP-HA-SVR01 systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..

Files that I have mentioned as inputs exist and logs are printed on them continuously as well. And also, those files have read permission for user, group and organization.

Can anyone please give me support on this?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.