Filebeat exec

Is there a way to run an exec on a file and then ship that output to logstash?

I think you might be looking for execbeat.

gave this a shot but it seems its not working correctly. Nothing is showing up in Elasticsearch.

Post your configuration files for Logstash and execbeat and Ill take a look

did a sample run with date. Maybe i am not grabbing the proper index? I assume it is the same as the others execbeat-*?

http://www.chopapp.com/#mbwdo1ey

im just sedning it to ES first. To see if i would even need to get logstash involved

logs in debug mode :

2017-03-08T17:08:39Z INFO execbeat is running! Hit CTRL-C to stop it.
2017-03-08T17:08:39Z DBG Creating poller # 0 with command: date
2017-03-08T17:08:39Z INFO Metrics logging every 30s
2017-03-08T17:09:09Z INFO No non-zero metrics in the last 30s

Do you actually have "hosts: ["hostname:9200"]" or are you just masking your ES hostname with the word "hostname"?

If the latter, replace "hostname" with the actual hostname of your ES instance

i have the actual hostname in there, jsut replaced it for commenting reasons

Anything in your ES logs?

nope all clean

Is ES listening on a local interface by any chance? (localhost)

Is execbeat and ES running on the same machine?

it is not, i have other stuff reporting to this ES instace no problem (metricbeat) . execbeat is running on a different host

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.