Filebeat doesn't seem to create index

Elastic Stack Beats
1

I have ELK setup on one server and logs i am trying to read on another. But on kibana i dont see index created from filebeat. Filebeat console output works properly and showing my logs.
filebeat.yml:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /opt/oasirx/app/spritcs/logs/*.log
  scan_frequency: 5s

output.elasticsearch:
  hosts: ["172.25.10.60:9200"]

xpack.montoring:
  enabled: true
  elasticsearch:
  hosts: ["172.25.10.60:9200"]
2

Welcome to our community! :smiley:

What do the Filebeat logs show?
Can you see anything in monitoring for the Filebeat instance?
What is the output of GET _cat/indices?v on Elasticsearch?

3

Thank you! I am new in ELK stack.

This is some lines from filebeat -e -d publish

{"log.level":"info","@timestamp":"2022-11-07T12:05:50.440+0300","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":132},"message":"Stopping Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-07T12:05:50.440+0300","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":166},"message":"Ending Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-07T12:05:50.441+0300","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":137},"message":"Registrar stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-07T12:05:50.464+0300","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":194},"message":"Total metrics","service.name":"filebeat","monitoring":{"metrics":{"beat":{"cpu":{"system":{"ticks":70,"time":{"ms":70}},"total":{"ticks":470,"time":{"ms":470},"value":470},"user":{"ticks":400,"time":{"ms":400}}},"handles":{"limit":{"hard":4096,"soft":1024},"open":9},"info":{"ephemeral_id":"1f5db730-c847-4217-b300-4e3845239911","name":"filebeat","uptime":{"ms":3417},"version":"8.5.0"},"memstats":{"gc_next":37911624,"memory_alloc":23543384,"memory_sys":38355976,"memory_total":75534384,"rss":91258880},"runtime":{"goroutines":16}},"filebeat":{"events":{"active":4108,"added":4115,"done":7},"harvester":{"closed":6,"open_files":0,"running":0,"skipped":0,"started":6},"input":{"log":{"files":{"renamed":0,"truncated":0}},"netflow":{"flows":0,"packets":{"dropped":0,"received":0}}}},"libbeat":{"config":{"module":{"running":0,"starts":0,"stops":0},"reloads":0,"scans":0},"output":{"events":{"acked":0,"active":0,"batches":0,"dropped":0,"duplicates":0,"failed":0,"toomany":0,"total":0},"read":{"bytes":0,"errors":0},"type":"elasticsearch","write":{"bytes":0,"errors":0}},"pipeline":{"clients":0,"events":{"active":4097,"dropped":0,"failed":0,"filtered":13,"published":4096,"retry":2048,"total":4110},"queue":{"acked":0,"max_events":4096}}},"registrar":{"states":{"cleanup":0,"current":16,"update":7},"writes":{"fail":0,"success":1,"total":1}},"system":{"cpu":{"cores":6},"load":{"1":12.48,"15":5.14,"5":8.76,"norm":{"1":2.08,"15":0.8567,"5":1.46}}}},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2022-11-07T12:05:50.464+0300","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":195},"message":"Uptime: 3.42033723s","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-07T12:05:50.464+0300","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":162},"message":"Stopping metrics logging.","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-07T12:05:50.464+0300","log.origin":{"file.name":"instance/beat.go","file.line":475},"message":"filebeat stopped.","service.name":"filebeat","ecs.version":"1.6.0"}
4

I tried to setup logstash but now i need to send logs directly ( Its index empty )

health status index                           uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .geoip_databases                N5__nlezSCmTg6P73lmZ8g   1   0         40           40     38.4mb         38.4mb
green  open   .apm-custom-link                URChHr2vQhCbAdCiuI0T7w   1   0          0            0       226b           226b
green  open   .kibana_task_manager_7.17.6_001 8vYz9lcPTCS-4jgQWRoKrQ   1   0         17         3779     50.9mb         50.9mb
green  open   .apm-agent-configuration        Qy4DCBwjQlOMHliDUbr-0g   1   0          0            0       226b           226b
green  open   .async-search                   n9V3QnchTAKDpZSeCxY-bg   1   0          0            0       253b           253b
yellow open   logstash-2022.11.03-000001      GGRoE9poR9KMC2Ng3CXmog   1   1          0            0       226b           226b
green  open   .kibana_7.17.6_001              vIvSZ2NtTZyJs5HIYxlyjQ   1   0        391           30      2.5mb          2.5mb
green  open   .tasks                          EuFxnQfzSICAQdDUIQtuUg   1   0          6            0       23kb           23kb
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.