Failed to start filebeat

[kuruzuke (Jayrald)]

im testing to check if my filebeat is running using this script " curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'" and the output was

{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : 0.0,
"hits" : [ ]
}
}

can you guys help me this.

thanks a lot in advance

[warkolm (Mark Walkom)]

That doesn't tell us much unfortunately.

Have you looked at the logs of things? What versions have you installed? What does your config look like?

[kuruzuke (Jayrald)]

version: OpenJDK Runtime Environment (build 1.8.0_161-b14)
configuration:

filebeat:
prospectors:
-
paths:
- /var/log/secure
- /var/log/messages
# - /var/log/*.log

  input_type: log
  
  document_type: syslog

registry_file: /var/lib/filebeat/registry

output:
logstash:
hosts: ["elk_server_private_ip:5044"]
bulk_max_size: 1024

tls:
  certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

shipper:

logging:
files:
rotateeverybytes: 10485760 # = 10MB

status of filebeat:

Process: 7860 ExecStart=/usr/bin/filebeat -c /etc/filebeat/filebeat.yml (code=exited, status=1/FAILURE

my source is : https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7#install-elasticsearch

i followed all the steps given in this tutorial to install all the services but when i test my connection. i cant get the same result as indicated in the tutorial.

(sorry if i cant give you the exact answer that want you to hear. im new for this tech.)
thanks.

[magnusbaeck (Magnus Bäck)]

Always post configurations as preformatted text. Use markdown or the </> toolbar button.

You need to locate the Filebeat log and inspect it. Since you appear to have installed Filebeat with the RPM you should find the log file in /var/log/filebeat (see https://www.elastic.co/guide/en/beats/filebeat/current/directory-layout.html).

Also, this is the Logstash category. You have a Filebeat problem, so I suggest you move this question to the Filebeat category.

[kuruzuke (Jayrald)]

thank you

[harshbajaj16 (Harsh Bajaj)]

can you pls share the logs of filebeat so that we can identify the exact issue...???

[kuruzuke (Jayrald)]

hi @harsh where can i get this log file?

[harshbajaj16 (Harsh Bajaj)]

you can check /var/log/filebeat and paste here..??

[kuruzuke (Jayrald)]

hi @harshbajaj16 thank you for your help my filebeat is now working.