Filebeat 6.5.0 does not send data to logstash 6.5.0


(Peter) #1

Hello,

I am using filebeat 6.5.0 with the following configuration:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/jetty/logs/*.log
  exclude_files: /home/jetty/logs/OLD/*
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
tags: ["jetty"]
fields_under_root: true
fields:
  serice: jetty
  "@environment": DEV
multiline.pattern: ^[A-Z,a-z]{3} [0-9]{2}, [0-9]{4}|\[GC|\[Full GC|Exeption in|\[[0-9]{2}-[0-9]{2}-[0-9]{4}|sm.
multiline.negate: true
multiline.match: after
setup.kibana:
  host: "10.0.0.5:5601"
output.logstash:
  hosts: ["10.0.0.5:5044", "10.0.0.6:5044"]
  loadbalance: true
  index: filebeat
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
logging.level: info
logging.selectors: ["*"]
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch:
  hosts: ["10.0.0.5:9200", "10.0.0.6:9200"]

Logstash is configured and listening on port 5400. I can telnet from the host where filebeat is running on. However I don't see the any data loading to logstash. I cannot even see any errors in logstash in case there are errors. I have enabled stdout in logstash output to see if anything is getting processed but nothing in the logs.

Any idea what can it be?

Thanks in advance
Peter


(Christian Dahlqvist) #2

I assume this is a typo as it looks like you are sending data to port 5044?


(Peter) #3

port 5044 is correct:

input {
  beats {
    # The port to listen on for filebeat connections.
    port => 5044
    # The IP address to listen for filebeat connections.
    host => "0.0.0.0"
  }
}

(Peter) #4

I have found out that the data is actually is being sent to logstash. It seam that for some reason logstash is not sending it to elasticsearch. Moving this to logstash


(system) closed #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.