FileBeat Debug Logging not Working?

Elastic Stack Beats
1

According to the docs filebeat -e -d "publish" should publish debug information about each event it sends (say to LogStash). This is not the case (Windows, ELK+FB 7.3).

filebeat.exe -c filebeat.dev.yml -e -d "publish"

Our filebeat.dev.yml has #logging.level: info commented out.

We see the harvester starting our file and we see the event land in logstash - but filebeat does not log it - indeed no DEBUG logs appear:

2019-09-04T10:58:36.450+0200    INFO    log/harvester.go:253    Harvester started for file: D:\tmp\log\console.dev.log
2019-09-04T10:58:42.467+0200    INFO    pipeline/output.go:95   Connecting to backoff(async(tcp://ecom-repository01:5052))
2019-09-04T10:58:42.472+0200    INFO    pipeline/output.go:105  Connection to backoff(async(tcp://ecom-repository01:5052)) established
2019-09-04T10:59:03.381+0200    INFO    [monitoring]    log/log.go:145  Non-zero metrics in the last 30s...

As an aside: these monitoring events are a real pain at INFO level.

2

filebeat -d "*" does show the Publish events but filebeat -d "Publish" (uppercase) does not. So how do these selectors work exactly?

filebeat -d "*"

2019-09-04T11:07:53.030+0200 DEBUG [processors] processing/processors.go:183 Publish event: {
"@timestamp": "2019-09-04T09:07:48.025Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "7.3.0"

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.