Filebeat beta1 not working for my prospectors .yml file that was working on alpha 5

Elastic Stack Beats
1

I have a large prospector list that was working fine on 5.0-alpha5.

If i upgrade filebeat to beta1 no logs are seen in kibana. I dont see any error on /var/log. If i downgrade to alpha5 logs can be seen on kibana again.

I cant paste all file here cause there is a limit.

2

can you share some filebeat logs + config? Did you use logstash output with tls?

3

@agonzalez You can share the logs and configs as a gist and only share the links here.

4

I found the problem, it was a blank line between one of the 41 paths/prospectors, look like alpha5 worked fine with that and beta1 no. I removed the blank line and service started to work fine.

thanks!

5

@agonzalez Interesting. Could you share the two different options you are talking about? Would be interesting to test if we broke here some BC.

Is that what you are referring to?

Before

filebeat.prospectors:
- paths:
  - test.log

  - test2.log

After

filebeat.prospectors:
- paths:
  - test.log
  - test2.log
6

No, I have 41 differents paths/document_types. It was something like:

-
  paths:
    - /usr/logs.dir/log1-*.log
  document_type: log1
  exclude_lines: ["^$"]
  fields:
   asset_tag: ${ASSET_TAG}

-
  paths:
    - /usr/logs.dir/log2-*.log
  document_type: log2
  exclude_lines: ["^$"]
  fields:
   asset_tag: ${ASSET_TAG}
7

Ok, and you removed the newline before the second - prospector and it worked again?

8

yes, that is what i did and fixed the issue. Before that I tried to "strings" the file in case there were some bad character also but until i realize there was a blank line and removed it didnt work.

9

This topic was automatically closed after 21 days. New replies are no longer allowed.