Filebeat 0 hits? Require help to resolve

Elastic Stack Elasticsearch
1

Hi!

I'm new to using the ELK stack and after configuring, installing the ELK stack and finally coming to filebeat, I can't seem to get a hit after running

curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'

and getting

{
"_index" : "filebeat-2016.01.29",
"_type" : "log",
"_id" : "AVKO98yuaHvsHQLa53HE",
"_score" : 1.0,
"_source":{"message":"Feb 3 14:34:00 rails sshd[963]: Server listening on :: port 22.","@version":"1","@timestamp":"2016-01-29T19:59:09.145Z","beat":{"hostname":"topbeat-u-03","name":"topbeat-u-03"},"count":1,"fields":null,"input_type":"log","offset":70,"source":"/var/log/auth.log","type":"log","host":"topbeat-u-03"}
}

like I'm supposed to. I am getting

{
"took" : 1
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
},
"hits" : {
"total" : 0
"max_score" : 0.0,
"hits" : [ ]
}
}

I can't seem to get it running and shown on the kibana discover page.

2

it looks like filebeats is not sending files. It is creating the index but no documents are created.

I had luck when troubleshooting logstash and filebeats to send the output to stdout so you can immediately see what is being sent w/o running queries.

Are you using filebeats directly to Elasticsearch or to logstash and then elasticsearch?

3

Please don't create multiple threads for the one issue - Filebeat Installation 0 hits? Troubleshoot