Filebeat docker

[Harsha606 (Harsha Kumar K)]

Hi All, I am using official filebeat image, below is my dockerfile.

FROM docker.elastic.co/beats/filebeat:7.1.1
COPY filebeat.yml /usr/share/filebeat/filebeat.yml
USER root
RUN mkdir /usr/share/filebeat/fb-configs
COPY configs /usr/share/filebeat/fb-configs
RUN chown -R root:filebeat /usr/share/filebeat/fb-configs
RUN chown root:filebeat /usr/share/filebeat/filebeat.yml

below is my filebeat.yml file:

filebeat.config.inputs:
enabled: true
path: /usr/share/filebeat/fb-configs/*.yml
output.kafka:
required_acks: 1
sasl.enabled.mechanisms: PLAIN
compression: none
codec.json:
pretty: false
hosts: ["broker.kafka-elk.l4lb.thisdcos.directory:9092"]
topics:

• topic: '%{[fields.env]}-%{[fields.log_type]}'

my filebeat container starts and start parsing the logs but it doesn't send any output to kafka

can anyone help me out here, thanks in advance!!!

[faec (Fae Charlton)]

The first thing I'd try is to use topic at the top-level rather than topics -- the latter is for an array of topics you want to use under different circumstances, and in this case it looks like you have only one. Using topics also expects a setting for when to decide between the different possibilities, which you don't have here and which might be causing problems.

If that doesn't work, could you share your configuration again surrounded by ```, e.g.

```
filebeat.config.inputs:
  enabled: true
  ...
```

this will preserve the indentation, since many configuration errors are caused by trying to set fields at the wrong indentation level.