Filebeat and grok parsing errors

Elastic Stack Beats
2

Hi @rdesanno,

filebeat doesn't support grok expressions on itself, what we do with modules is to prepare a set of predefined pipelines that are installed in the elasticsearch ingest nodes, the json files you see contain these definitions.

If you need to define your own grok patterns, you can define and add your own pipeline. Once added you can add to the filebeat configuration a log input with:

  • The paths to the files you want to collect and parse
  • The pipeline option set to your created pipeline

If you think that your custom patterns can be used by more people, or can be included in the apache module, we'll be happy to accept them as contributions in filebeat :slight_smile:

Regarding the error enabling modules, your filebeat.yml configuration file needs to include the path to the modules configuration, something like this:

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

But these lines are already included in our distributed packages, how are you installing filebeat? Do you overwrite the configuration file?