Странно, надругих хостах у меня все работает именно в формате:
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /varl/log/messages
После того как привожу конфиг к вашему формату:
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /varl/log/messages
Получаю ошибку
[root@app filebeat]# /etc/init.d/filebeat start
Starting filebeat: Exiting: error loading config file: yaml: line 68: did not find expected <document start>
Видимо съехали поля при редактировании, привожу конфиг к нормальному виду и все запускается
root@app filebeat]# /etc/init.d/filebeat start
Starting filebeat: 2020-07-03T10:00:17.627+0300 INFO instance/beat.go:571 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-07-03T10:00:17.627+0300 INFO instance/beat.go:579 Beat ID: ee7adef5-45a4-4baa-ab06-966a2db6c22c
2020-07-03T10:00:17.627+0300 INFO [index-management.ilm] ilm/ilm.go:129 Policy name: filebeat-7.1.0
2020-07-03T10:00:17.630+0300 INFO [beat] instance/beat.go:827 Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "ee7adef5-45a4-4baa-ab06-966a2db6c22c"}}}
2020-07-03T10:00:17.630+0300 INFO [beat] instance/beat.go:836 Build info {"system_info": {"build": {"commit": "03b3db2a1d9d76fdf10475e829fce436c61901e4", "libbeat": "7.1.0", "time": "2019-05-15T23:59:19.000Z", "version": "7.1.0"}}}
2020-07-03T10:00:17.630+0300 INFO [beat] instance/beat.go:839 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.11.5"}}}
2020-07-03T10:00:17.632+0300 INFO [beat] instance/beat.go:843 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-05-21T14:40:54+03:00","containerized":true,"name":"app.dev","ip":["127.0.0.1/8","::1/128","192.168.0.206/24","fe80::20c:29ff:fe95:eb75/64"],"kernel_version":"2.6.32-754.15.3.el6.x86_64","mac":["00:0c:29:95:eb:75"],"os":{"family":"redhat","platform":"centos","name":"CentOS","version":"6.10 (Final)","major":6,"minor":10,"patch":0,"codename":"Final"},"timezone":"MSK","timezone_offset_sec":10800,"id":"628a515858a7dc0c40847abf00000008"}}}
2020-07-03T10:00:17.632+0300 INFO [beat] instance/beat.go:872 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"ambient":null}, "cwd": "/etc/filebeat", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 53464, "ppid": 53463, "seccomp": {"mode":""}, "start_time": "2020-07-03T10:00:16.630+0300"}}}
2020-07-03T10:00:17.632+0300 INFO instance/beat.go:280 Setup Beat: filebeat; Version: 7.1.0
2020-07-03T10:00:17.633+0300 INFO [publisher] pipeline/module.go:97 Beat name: app.dev
Config OK
[ OK ]
Вот секция output:
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["192.168.0.246:5044"]
protocol: "https"
index: "messages3-%{[beat.version]}-%{+yyyy.MM.dd}"
setup.template.name: "messages3"
setup.template.pattern: "*-messages3-%{[beat.version]}-*"
setup.template.enabled: true
compression_level: 9
Но в кибане я его так и не вижу(((
Единственное отличие этого хоста от других, в центоси 6.10, на других 7-ка и версии filebeat 7.1.0 после того как не взлетело на 7.8.0, хотя и та и другая версия совместимы по матрице со стеком ELK версии 7.8.0 который я развернул.
В чем проблема непонятно.