Filebeat cannot send output to logstash

Elastic Stack Beats
1

Dear ALL,

iam trying to configure filebeat to send output to logstash, after running command filebeat setup i found this error message
Exiting: Index management requested but the Elasticsearch output is not configured/enabled

using filebeat 7.2 and also logstash and elasticsearh
Filebeat config

- type: log
  enabled: true
  paths:
    - "/var/log/apache/*.log"
	
multiline.pattern: ^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}
multiline.negate: true
multiline.match: after

path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
output.logstash:
  hosts: ["192.168.11.10:5044"]

if i set to elasticsearch ouput its working need help for this situation
this is log fileabeat

2019-06-28T17:55:32.865+0700	INFO	instance/beat.go:606	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2019-06-28T17:55:32.866+0700	INFO	instance/beat.go:614	Beat ID: 1dd167f0-f0a2-4c40-a324-0abc904c76e4
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:902	Beat info	{"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "1dd167f0-f0a2-4c40-a324-0abc904c76e4"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:911	Build info	{"system_info": {"build": {"commit": "9ba65d864ca37cd32c25b980dbb4020975288fc0", "libbeat": "7.2.0", "time": "2019-06-20T15:05:30.000Z", "version": "7.2.0"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:914	Go runtime info	{"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.12.4"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:918	Host info	{"system_info": {"host": {"architecture":"x86_64","boot_time":"2019-06-28T11:04:53+07:00","containerized":false,"name":"masternode.local.com","ip":["127.0.0.1/8","::1/128","192.168.11.10/25","fe80::77b5:55e5:5b8f:a94d/64"],"kernel_version":"3.10.0-957.el7.x86_64","mac":["00:0c:29:6e:4f:a5"],"os":{"family":"redhat","platform":"centos","name":"CentOS Linux","version":"7 (Core)","major":7,"minor":6,"patch":1810,"codename":"Core"},"timezone":"WIB","timezone_offset_sec":25200,"id":"359519df05234eee84b855a24d246937"}}}
2019-06-28T17:55:32.867+0700	INFO	[beat]	instance/beat.go:947	Process info	{"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend"],"ambient":null}, "cwd": "/etc/filebeat", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 1605, "ppid": 31546, "seccomp": {"mode":"disabled"}, "start_time": "2019-06-28T17:55:32.100+0700"}}}
2019-06-28T17:55:32.867+0700	INFO	instance/beat.go:292	Setup Beat: filebeat; Version: 7.2.0
2019-06-28T17:55:32.868+0700	INFO	[publisher]	pipeline/module.go:97	Beat name: masternode.local.com
2019-06-28T17:55:32.868+0700	ERROR	instance/beat.go:877	Exiting: Index management requested but the Elasticsearch output is not configured/enabled
2

I don't see it explicitly enabled in your configuration that you've provided, however it seems Filebeat is trying to setup Index Lifecycle Management rules on your Elasticsearch cluster. Since you're not connecting to Elasticsearch directly, and you're sending to Logstash instead you can probably just add the below to your config to disable this:

setup.ilm.enabled: false

3

Hi Evesy,

already input setup.ilm.enabed: false , still facing same issue..
any idea about this really need help...

i have 2 dedicated node and 1 masternode so i installed filebeat in masternode.

Thanks

4

remove all setup.template config and add this:

setup.template.enabled: false
5

Hi Martin,

still the same not resolve the problem
Exiting: Index management requested but the Elasticsearch output is not configured/enabled

6

Could you share your full config now that you've added those extras?

Perhaps they're not in the right place or something

7

HI @Evesy its working now reinstall filebeat and manually import template then running filebeat.

8

Beats can not setup templates when publishing via Logstash. You need to configure the index setup in Logstash. I guess the presence of setup.template.settings: triggers the error message.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.