● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Thu 2022-11-24 17:09:22 IST; 7min ago
Docs: https://www.elastic.co/beats/filebeat
Process: 15858 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=1/FAILURE)
Main PID: 15858 (code=exited, status=1/FAILURE)
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: Unit filebeat.service entered failed state.
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: filebeat.service failed.
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: filebeat.service holdoff time over, scheduling restart.
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: start request repeated too quickly for filebeat.service
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: Unit filebeat.service entered failed state.
Nov 24 17:09:22 vl070073-app2-pd-a15-sms-aws-test-mum-in-vf.vfirst.local systemd[1]: filebeat.service failed.
less /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
id: my-filestream-id
enabled: true
paths:
- /opt/elk/log/elasticsearch/*.log
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 1
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
logging.level: debug
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0640
output.logstash:
hosts: ["localhost:5044"]
type: log
enabled: true
paths: /opt/elk/log/elasticsearch/*.json
worker: 1
less {filebeat_home}/module/logstash/module.yml
- module: logstash
log:
enabled: true
var.paths: ["/var/log/logstash/logstash.log*"]
slowlog:
enabled: true
var.paths: ["/var/log/logstash/logstash-slowlog.log*"]