I am trying to follow this tutorial here to build a dashboard on some public data sets.
However, whenever I tried to run ./filebeat, the following error appeared:
2021-03-31T14:19:44.685+0800 ERROR [modules] fileset/modules.go:131 Not loading modules. Module directory not found: /usr/share/filebeat/bin/module
And I have found this post here
I see the same info popping up in the terminal, meaning that the path are not configured correctly.
2020-06-08T17:49:34.832-0500 INFO instance/beat.go:622 Home path: [/usr/share/filebeat/bin] Config path: [/etc/filebeat] Data path: [/usr/share/filebeat/bin/data] Logs path: [/usr/share/filebeat/bin/logs]
I tried modifying /etc/filebeat/filebeat.yml as stated in here, but it doesn't work.
Then I noted that there's some customized configuration in this example data set(you need to move a custom .yml (ncedc-earthquakes-filebeat.yml) to the /usr/share/filebeat/ directory). Then I tried to add the above configuration to this
filebeat.inputs: # - /var/log/*.log # - /usr/share/filebeat # - /etc/filebeat # - /var/lib/filebeat # - /var/log/filebeat
The following error occured:
Exiting: error loading config file: yaml: line 11: found character that cannot start any token
I am not sure what I did wrong with adding the config, as I am not sure how to do it as well. Any help would be appreciated, thank you
(If it helps: my version of ELK is as follows, all installed with RPM on a Centos 7)
Elasticsearch, Logstash, Kibana: 7.11.2