Filebeat config is OK, but Not Started & Not Working

Elastic Stack Beats
1

im installed a filebeat on server Which is to send nginx log to logstash
im download filebeat .deb package (x64)
and install "dpkg --install filebeat ... .deb"
and successfully install .
But service filebeat not working ... with error

root@storage-a-01:/etc/filebeat# journalctl -xe
Jan 25 17:52:07 storage-a-01 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Jan 25 17:52:07 storage-a-01 systemd[1]: filebeat.service: Unit entered failed state.
Jan 25 17:52:07 storage-a-01 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Jan 25 17:52:07 storage-a-01 systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
Jan 25 17:52:07 storage-a-01 systemd[1]: Stopped filebeat.
-- Subject: Unit filebeat.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit filebeat.service has finished shutting down.
Jan 25 17:52:07 storage-a-01 systemd[1]: Started filebeat.
-- Subject: Unit filebeat.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit filebeat.service has finished starting up.
-- 
-- The start-up result is done.
Jan 25 17:52:07 storage-a-01 filebeat[10261]: Exiting: 1 error: invalid config: yaml: line 9: did not find expected key
Jan 25 17:52:07 storage-a-01 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Jan 25 17:52:07 storage-a-01 systemd[1]: filebeat.service: Unit entered failed state.
Jan 25 17:52:07 storage-a-01 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Jan 25 17:52:08 storage-a-01 systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
Jan 25 17:52:08 storage-a-01 systemd[1]: Stopped filebeat.
-- Subject: Unit filebeat.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit filebeat.service has finished shutting down.
Jan 25 17:52:08 storage-a-01 systemd[1]: Started filebeat.
-- Subject: Unit filebeat.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit filebeat.service has finished starting up.
-- 
-- The start-up result is done.
Jan 25 17:52:08 storage-a-01 filebeat[10279]: Exiting: 1 error: invalid config: yaml: line 9: did not find expected key
Jan 25 17:52:08 storage-a-01 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Jan 25 17:52:08 storage-a-01 systemd[1]: filebeat.service: Unit entered failed state.
Jan 25 17:52:08 storage-a-01 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Jan 25 17:52:08 storage-a-01 systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
Jan 25 17:52:08 storage-a-01 systemd[1]: Stopped filebeat.
-- Subject: Unit filebeat.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit filebeat.service has finished shutting down.
Jan 25 17:52:08 storage-a-01 systemd[1]: Started filebeat.
-- Subject: Unit filebeat.service has finished start-up
-- Defined-By: systemd

im using this command
filebeat -configtest -c filebeat.yml -e
==> Result == Config OK

im result "systemctl status filebeat.service"
root@storage-a-01:~# systemctl status filebeat.service
● filebeat.service - filebeat
Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html

Jan 27 16:07:32 storage-a-01 systemd[1]: Stopped filebeat.
Jan 27 16:07:32 storage-a-01 systemd[1]: Started filebeat.
Jan 27 16:07:32 storage-a-01 filebeat[25950]: Exiting: 1 error: invalid config: yaml: line 9: did not find expected key
Jan 27 16:07:32 storage-a-01 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Jan 27 16:07:32 storage-a-01 systemd[1]: filebeat.service: Unit entered failed state.
Jan 27 16:07:32 storage-a-01 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Jan 27 16:07:32 storage-a-01 systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.
Jan 27 16:07:32 storage-a-01 systemd[1]: Stopped filebeat.
Jan 27 16:07:32 storage-a-01 systemd[1]: filebeat.service: Start request repeated too quickly.
Jan 27 16:07:32 storage-a-01 systemd[1]: Failed to start filebeat.
2

This filebeat log

root@storage-a-01:/usr/share/filebeat/bin# filebeat -c /etc/filebeat/filebeat.yml -e -d "*" 
2018/01/27 13:16:17.981634 beat.go:436: INFO Home path: [/usr/share/filebeat/bin] Config path: [/usr/share/filebeat/bin] Data path: [/usr/share/filebeat/bin/data] Logs path: [/usr/share/filebeat/bin/logs]
2018/01/27 13:16:17.981750 beat.go:463: DBG [beat] Beat metadata path: /usr/share/filebeat/bin/data/meta.json
2018/01/27 13:16:17.981756 metrics.go:23: INFO Metrics logging every 30s
2018/01/27 13:16:17.981943 beat.go:443: INFO Beat UUID: 7e34dac8-310a-468c-92c7-bb44120eb124
2018/01/27 13:16:17.982024 beat.go:203: INFO Setup Beat: filebeat; Version: 6.1.2
2018/01/27 13:16:17.982158 beat.go:215: DBG [beat] Initializing output plugins
2018/01/27 13:16:17.982211 processor.go:49: DBG [processors] Processors: 
2018/01/27 13:16:17.982748 client.go:123: INFO Elasticsearch url: http://localhost:9200
2018/01/27 13:16:17.983570 logger.go:18: DBG [publish] start pipeline event consumer
2018/01/27 13:16:17.983706 module.go:76: INFO Beat name: storage-a-01
2018/01/27 13:16:17.983843 modules.go:95: ERR Not loading modules. Module directory not found: /usr/share/filebeat/bin/module
2018/01/27 13:16:17.984073 beat.go:276: INFO filebeat start running.
2018/01/27 13:16:17.984228 registrar.go:88: INFO Registry file set to: /usr/share/filebeat/bin/data/registry
2018/01/27 13:16:17.984336 registrar.go:108: INFO Loading registrar data from /usr/share/filebeat/bin/data/registry
2018/01/27 13:16:17.984444 registrar.go:119: INFO States Loaded from registrar: 0
2018/01/27 13:16:17.984493 crawler.go:48: INFO Loading Prospectors: 1
2018/01/27 13:16:17.984683 reload.go:95: DBG [cfgfile] Checking module configs from: /usr/share/filebeat/bin/modules.d/*.yml
2018/01/27 13:16:17.984827 reload.go:109: DBG [cfgfile] Number of module configs found: 0
2018/01/27 13:16:17.984878 crawler.go:82: INFO Loading and starting Prospectors completed. Enabled prospectors: 0
2018/01/27 13:16:17.984994 registrar.go:150: INFO Starting Registrar
2018/01/27 13:16:17.985185 reload.go:127: INFO Config reloader started
2018/01/27 13:16:17.985361 reload.go:151: DBG [cfgfile] Scan for new config files
2018/01/27 13:16:17.985457 reload.go:170: DBG [cfgfile] Number of module configs found: 0
2018/01/27 13:16:17.985495 reload.go:219: INFO Loading of config files completed.
2018/01/27 13:16:47.983094 metrics.go:39: INFO Non-zero metrics in the last 30s: beat.info.uptime.ms=30007 beat.memstats.gc_next=4473924 beat.memstats.memory_alloc=2848624 beat.memstats.memory_total=2848624 filebeat.harvester.open_files=0 filebeat.harvester.running=0 libbeat.config.module.running=0 libbeat.config.reloads=1 libbeat.output.type=elasticsearch libbeat.pipeline.clients=0 libbeat.pipeline.events.active=0 registrar.states.current=0
3

Please share your configuration in /etc/filebeat/filebeat.yml.

4

/etc/filebeat/filebeat.yml ==>

https://file.io/3CgvSn

5

im nginx.yml renamed to nginx.yml.disabled .
and started Filebeat ...
but not sended log to logstash ...
my filebeat.reference.yml config:
https://file.io/dPTU5Q

6

What should I do ?

8 
**root@storage-a-01:/etc/filebeat# sudo /etc/init.d/filebeat start**

[ ok ] Starting filebeat (via systemctl): filebeat.service.



**root@storage-a-01:/etc/filebeat# sudo /etc/init.d/filebeat status**

● filebeat.service - filebeatLoaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled)Active: inactive (dead)Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.htmlJan 28 15:31:30 storage-a-01 systemd[1]: Started filebeat.Jan 28 15:31:30 storage-a-01 filebeat[5813]: filebeat2018/01/28 12:01:30.690716 beat.go:635: CRIT Exiting: error loading config file: yaml: block sequence entri...is contextJan 28 15:31:30 storage-a-01 filebeat[5813]: Exiting: error loading config file: yaml: block sequence entries are not allowed in this contextJan 28 15:31:30 storage-a-01 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILUREJan 28 15:31:30 storage-a-01 systemd[1]: filebeat.service: Unit entered failed state.Jan 28 15:31:30 storage-a-01 systemd[1]: filebeat.service: Failed with result 'exit-code'.Jan 28 15:31:30 storage-a-01 systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.Jan 28 15:31:30 storage-a-01 systemd[1]: Stopped filebeat.Jan 28 15:31:30 storage-a-01 systemd[1]: filebeat.service: Start request repeated too quickly.Jan 28 15:31:30 storage-a-01 systemd[1]: Failed to start filebeat.Hint: Some lines were ellipsized, use -l to show in full.root@storage-a-01:/etc/filebeat#
9

The attached file is no longer available. Can you upload it again? Only the filebeat.yml is needed.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.