I am running rails application on this server and i want to forward rails logs to logstash installed on another centos server . I have added logstasher gem for json formatted logs.
But when i do sudo service filebeat start, i get the following error:
filebeat.service - filebeat
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Tue 2017-10-24 08:58:52 UTC; 1min 58s ago
Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
Process: 7960 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
Main PID: 7960 (code=exited, status=1/FAILURE)
Oct 24 08:58:52 localhost.localdomain systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Oct 24 08:58:52 localhost.localdomain systemd[1]: Unit filebeat.service entered failed state.
Oct 24 08:58:52 localhost.localdomain systemd[1]: filebeat.service failed.
Oct 24 08:58:52 localhost.localdomain systemd[1]: filebeat.service holdoff time over, scheduling restart.
Oct 24 08:58:52 localhost.localdomain systemd[1]: start request repeated too quickly for filebeat.service
Oct 24 08:58:52 localhost.localdomain systemd[1]: Failed to start filebeat.
Oct 24 08:58:52 localhost.localdomain systemd[1]: Unit filebeat.service entered failed state.
Oct 24 08:58:52 localhost.localdomain systemd[1]: filebeat.service failed.
filebeat:
prospectors:
paths:
- /vagrant/demo/log/logstash_development.log
input_type: log
fields:
# level: debug
# review: 1
tags: ['json']
fields_under_root: true
document_type: log
output:
logstash:
hosts: ["192.168.33.10:5044"]
bulk_max_size: 1024
index: filebeat
tls:
# List of root certificates for HTTPS server verifications
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
path: "/tmp/filebeat"
logging:
to_files: true
path: /var/log/mybeat
rotateeverybytes: 10485760 # = 10MB