I'm a newbie on Elasticsearch and I'm having some problems:
I have a cluster of 2 Elasticsearch (but I do most things with one) and a separate kibana.
I would like to retrieve logs from network devices and ESXi
So I'm doing some tests with the ESXi's, sending the logs to my Elasticsearch server.
Currently I have Metricbeat installed and it works fine.
I would like to use Filebeat and/or Logstash to retrieve and send the logs to Elasticsearch
The problems are the following:
using Filebeat :
when I set Elasticsearch to output, it doesn't receive anything, but when I do filebeat test output, or filebeat test config, everything is ok, so I think it doesn't receive anything but I'm not sure and don't know how to see this.
when I set Logstash as output, I configure Logstash with Beats input, but when I do a netstat -an | grep "LISTEN", no application listens on port 5044 (I tried with different ports, but logstash never listens)
I hope that I have stated my expectations and problems, and I thank you in advance for your help
All right, thank you!
I tried quickly to send to logstash with your configuration but it didn't work either, the port I assign to logstash (here 5044) is not on listen when I do a netstat -an | grep "LISTEN"
Here is one of the files in the conf.d directory of my Logstash:
tail -f /var/log/logstash/logstash-plain.log
[2021-10-20T12:24:01,440][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/main-*.conf"}
[2021-10-20T12:24:01,462][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/dead_letter_queue-*.conf"}
[2021-10-20T12:24:01,495][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2021-10-20T12:24:02,185][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2021-10-20T12:24:07,146][INFO ][logstash.runner ] Logstash shut down.
[2021-10-20T12:24:07,214][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.19.0.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.19.0.jar:?]
at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]
and for the journalctl -ru logstash :
oct. 21 13:55:59 eol-elastic-01.maquette.lan logstash[8746]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecate
oct. 21 13:55:58 eol-elastic-01.maquette.lan logstash[8746]: Using bundled JDK: /usr/share/logstash/jdk
oct. 21 13:55:58 eol-elastic-01.maquette.lan systemd[1]: Started logstash.
oct. 21 13:55:58 eol-elastic-01.maquette.lan systemd[1]: Stopped logstash.
oct. 21 13:55:58 eol-elastic-01.maquette.lan systemd[1]: logstash.service holdoff time over, scheduling restart.
oct. 21 13:55:58 eol-elastic-01.maquette.lan systemd[1]: logstash.service failed.
oct. 21 13:55:58 eol-elastic-01.maquette.lan systemd[1]: Unit logstash.service entered failed state.
oct. 21 13:55:58 eol-elastic-01.maquette.lan systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE
oct. 21 13:55:58 eol-elastic-01.maquette.lan logstash[8688]: at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstas
oct. 21 13:55:58 eol-elastic-01.maquette.lan logstash[8688]: at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-compl
oct. 21 13:55:58 eol-elastic-01.maquette.lan logstash[8688]: at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-compl
oct. 21 13:55:58 eol-elastic-01.maquette.lan logstash[8688]: org.jruby.exceptions.SystemExit: (SystemExit) exit
oct. 21 13:55:58 eol-elastic-01.maquette.lan logstash[8688]: [FATAL] 2021-10-21 13:55:58.339 [main] Logstash - Logstash stopped proces
oct. 21 13:55:58 eol-elastic-01.maquette.lan logstash[8688]: ERROR: Failed to parse YAML file "/etc/logstash/logstash.yml". Please con
oct. 21 13:54:43 eol-elastic-01.maquette.lan logstash[8688]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecate
oct. 21 13:54:42 eol-elastic-01.maquette.lan logstash[8688]: Using bundled JDK: /usr/share/logstash/jdk
oct. 21 13:54:42 eol-elastic-01.maquette.lan systemd[1]: Started logstash.
oct. 21 13:54:42 eol-elastic-01.maquette.lan systemd[1]: Stopped logstash.
oct. 21 13:54:42 eol-elastic-01.maquette.lan systemd[1]: logstash.service holdoff time over, scheduling restart.
oct. 21 13:54:42 eol-elastic-01.maquette.lan systemd[1]: logstash.service failed.
oct. 21 13:54:42 eol-elastic-01.maquette.lan systemd[1]: Unit logstash.service entered failed state.
oct. 21 13:54:42 eol-elastic-01.maquette.lan systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE
oct. 21 13:54:42 eol-elastic-01.maquette.lan logstash[8632]: at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstas
oct. 21 13:54:42 eol-elastic-01.maquette.lan logstash[8632]: at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-compl
oct. 21 13:54:42 eol-elastic-01.maquette.lan logstash[8632]: at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-compl
oct. 21 13:54:42 eol-elastic-01.maquette.lan logstash[8632]: org.jruby.exceptions.SystemExit: (SystemExit) exit
oct. 21 13:54:42 eol-elastic-01.maquette.lan logstash[8632]: [FATAL] 2021-10-21 13:54:42.236 [main] Logstash - Logstash stopped proces
oct. 21 13:54:42 eol-elastic-01.maquette.lan logstash[8632]: ERROR: Failed to parse YAML file "/etc/logstash/logstash.yml". Please con
oct. 21 13:53:32 eol-elastic-01.maquette.lan logstash[8632]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecate
oct. 21 13:53:32 eol-elastic-01.maquette.lan logstash[8632]: Using bundled JDK: /usr/share/logstash/jdk
oct. 21 13:53:32 eol-elastic-01.maquette.lan systemd[1]: Started logstash.
oct. 21 13:53:32 eol-elastic-01.maquette.lan systemd[1]: Stopped logstash.
oct. 21 13:53:32 eol-elastic-01.maquette.lan systemd[1]: logstash.service holdoff time over, scheduling restart.
oct. 21 13:53:32 eol-elastic-01.maquette.lan systemd[1]: logstash.service failed.
oct. 21 13:53:32 eol-elastic-01.maquette.lan systemd[1]: Unit logstash.service entered failed state.
oct. 21 13:53:32 eol-elastic-01.maquette.lan systemd[1]: logstash.service: main process exited, code=exited, status=1/FAILURE
It seems that I have a problem with logstash, and I hadn't seen it, as it is "active" when I do a systemctl logstash status
I hope so! I've been working on it for a few days and I'm doing a lot of testing, I was starting to despair
Hi !
Thanks ! I've check and I've found the problem with the syntax error but I've always an error, this time with the Dead_queue_letter if I remember correctly.
But, on an other hand, Filebeat works ! Filebeat can send logs to Elasticsearch.
Apparently, by commenting on these 2 lines on the section output.Elasticsearch to my Filebeat.yml file, it works:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.