Filebeat-Apache Module- Nodata

Elastic Stack Beats
1

Hello,

I configure filebeat in my system, the probleme is, whaen i configure the modure system , i receive all datas and graphic, it is not the same for apache. We donot receive anaything

I have enable the module and configure the path

- module: apache
** # Access logs**
** access:**
** enabled: true**

** # Set custom paths for the log files. If left empty,**
** # Filebeat will choose the paths depending on your OS.**
** var.paths: ["/var/log/httpd/dispatcher_access_log"]**

Still no datas, can i have some help please ?

2

Hi @emmanuel_stevens_LED

Does the file /var/log/httpd/dispatcher_access_log exist? Do you see any errors related to the apache module, to the defined file path when starting filebeat?

3

yes, the file existe and i see no error from filebeat. System module send his datas perfectly

4

There are many possible reasons ....

What version are you on?

Did you enable the apache module?

filebeat modules enable apache

Did you run setup before starting filebeat?

filebeat setup -e

When you say you do not see the logs... Where are you looking Discover?

So your file has no extension?

/var/log/httpd/dispatcher_access_log

Are these common apache logs? or have they been customized?

In the filebeat logs you should see that that path... something like

2022-09-23T11:57:58.769-0700    INFO    [input] log/input.go:171        Configured paths: [/usr/local/var/log/apache2/access_log*]      {"input_id": "311cfe37-e4f4-4587-a387-885b78c57f6c"}
2022-09-23T11:57:58.770-0700    INFO    [input] log/input.go:171        Configured paths: [/usr/local/var/log/apache2/error_log*]       {"input_id": "847e93b7-2442-4c0c-a88a-063b761b095f"}
5

What version are you on?
I am on version 8.3.3
Did you enable the apache module?
Yes, i did
Did you run setup before starting filebeat?
yes, i did
So your file has no extension?
exactly, it is an linux file

**In the filebeat lo, i see the path :**slight_smile:

Oct 12 10:49:14 prllgsdpr001 filebeat[1828153]: {"log.level":"debug","@timestamp":"2022-10-12T10:49:14.593-0400","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":210},"message":"Publish event: {\n \"@timestamp\": \"2022-10-12T14:49:14.593Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.3.3\",\n \"pipeline\": \"filebeat-8.3.3-apache-access-pipeline\"\n },\n \"message\": \"162.158.51.178 - - [12/Oct/2022:10:49:07 -0400] \\\"GET / HTTP/1.1\\\" 301 258\",\n \"input\": {\n \"type\": \"log\"\n },\n \"fileset\": {\n \"name\": \"access\"\n },\n \"ecs\": {\n \"version\": \"1.12.0\"\n },\n \"host\": {\n \"mac\": [\n \"00:50:56:8c:bf:cf\"\n ],\n \"hostname\": \"Somehost\",\n \"architecture\": \"x86_64\",\n \"os\": {\n \"platform\": \"rhel\",\n \"version\": \"8.6 (Ootpa)\",\n \"family\": \"redhat\",\n \"name\": \"Red Hat Enterprise Linux\",\n \"kernel\": \"4.18.0-240.15.1.el8_3.x86_64\",\n \"codename\": \"Ootpa\",\n \"type\": \"linux\"\n },\n \"id\": \"d50e1f42ad1944a1a264a49359ba1832\",\n \"containerized\": false,\n \"ip\": [\n \"172.17.6.20\",\n \"fe80::250:56ff:fe8c:bfcf\"\n ],\n \"name\": \"Somehost\"\n },\n \"agent\": {\n \"type\": \"filebeat\",\n \"version\": \"8.3.3\",\n \"ephemeral_id\": \"76456cf1-3eb5-4eca-9ae3-1aa486981d98\",\n \"id\": \"ade45ee9-44bb-4c9a-8681-bf66b293de33\",\n \"name\": \"Somehost\"\n },\n \"log\": {\n \"offset\": 47089131,\n \"file\": {\n \"path\": \"/var/log/httpd/dispatcher_access_log\"\n }\n },\n \"event\": {\n \"dataset\": \"apache.access\",\n \"module\": \"apache\"\n },\n \"service\": {\n \"type\": \"apache\"\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}

6

Please format your code / logs in the future using the </> button.

Looks to me perhaps the file has already been read? Or is it constantly being appended to?

FIlebeat will only read a file once ... if you want to reload it you will need to clean out the data registry in the filebeat data path. Find that directory and clean it out... that will reset the registry.

Are there any other error messages in the filebeat logs?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.