I have an Elastic stack working A-OK (afaik). Filebeat runs great on the local machine, sending to logstash, and everything looks good in Kibana.
I am now trying to send logs from a remote machine and it does not appear to work, but I can't find any errors. This makes me think I have something misconfigured.
Filebeat installation and config is identical on both servers:
filebeat.yml (on both the server and client machines)
output.logstash: # The Logstash hosts hosts: ["10.137.4.219:5044"]
I'm using the filebeat "system" module for both client and server machines.
Enabling filebeat on the server populates data like crazy. Enabling it on the remote client does nothing, but it shows that a connection is established:
from /var/log/filebeat/filebeat on the client machine:
|2019-03-22T11:37:32.207-0600|INFO|log/harvester.go:255|Harvester started for file: /var/log/syslog| |---|---|---|---| |2019-03-22T11:37:32.207-0600|INFO|log/harvester.go:255|Harvester started for file: /var/log/auth.log| |2019-03-22T11:37:33.208-0600|INFO|pipeline/output.go:95|Connecting to backoff(async(tcp://10.137.4.219:5044))| |2019-03-22T11:37:33.208-0600|INFO|pipeline/output.go:105|Connection to backoff(async(tcp://10.137.4.219:5044)) established|
Is this a filebeat misconfig or a logstash one? Should I be using the same config for all clients that I want to send logs over to logstash?