kuruzuke
(Jayrald)
April 13, 2018, 2:52am
1
im testing to check if my filebeat is running using this script " curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty '" and the output was
{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : 0.0,
"hits" : [ ]
}
}
can you guys help me this.
thanks a lot in advance
warkolm
(Mark Walkom)
April 13, 2018, 3:18am
2
That doesn't tell us much unfortunately.
Have you looked at the logs of things? What versions have you installed? What does your config look like?
kuruzuke
(Jayrald)
April 13, 2018, 3:41am
3
version: OpenJDK Runtime Environment (build 1.8.0_161-b14)
configuration:
filebeat:
prospectors:
-
paths:
- /var/log/secure
- /var/log/messages
# - /var/log/*.log
input_type: log
document_type: syslog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["elk_server_private_ip:5044"]
bulk_max_size: 1024
tls:
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]
shipper:
logging:
files:
rotateeverybytes: 10485760 # = 10MB
status of filebeat:
Process: 7860 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE
my source is : https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7#install-elasticsearch
i followed all the steps given in this tutorial to install all the services but when i test my connection. i cant get the same result as indicated in the tutorial.
(sorry if i cant give you the exact answer that want you to hear. im new for this tech.)
thanks.
Always post configurations as preformatted text. Use markdown or the </>
toolbar button.
You need to locate the Filebeat log and inspect it. Since you appear to have installed Filebeat with the RPM you should find the log file in /var/log/filebeat (see https://www.elastic.co/guide/en/beats/filebeat/current/directory-layout.html ).
Also, this is the Logstash category. You have a Filebeat problem, so I suggest you move this question to the Filebeat category.
can you pls share the logs of filebeat so that we can identify the exact issue...???
kuruzuke
(Jayrald)
April 13, 2018, 8:39am
7
hi @harsh where can i get this log file?
you can check /var/log/filebeat and paste here..??
kuruzuke
(Jayrald)
April 13, 2018, 9:08am
9
hi @harshbajaj16 thank you for your help my filebeat is now working.
system
(system)
Closed
May 11, 2018, 9:08am
10
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.