Filebeat: field "log.file" - is empty

Elastic Stack Beats
1

Hi There,
Hope you are good.
Help to understand what is the reason

# Custom filebeat-module
- module: my-service
  ## Requests logs
  requests:
    enabled: true
    var.paths: ["/var/lib/lxd/containers/ZZ/rootfs/var/www/logs/requests.log", "/var/lib/lxd/containers/YY/rootfs/var/www/logs/requests_se.log"]
    var.input: "file"

And Then in Kibana I see:

{
    "log": {
      "file": {},
      "offset": 1079568
}

So what kind of log filebeat is processed??
Why field - log.file - is null? (empty)

filebeat version 7.1.0 (amd64), libbeat 7.1.0 [03b3db2a1d9d76fdf10475e829fce436c61901e4 built 2019-05-15 23:59:19 +0000 UTC]

Thx

2
  • i'm check - all pipelines (for example removed fields) - and nothings

_ingest/pipeline?pretty - 'remove.field' is not present

Just try it (field: log.file) on non-custom-module case?
Ok.

3

Could you please share the debug logs?

4

@kvch thx!

Sorry, I seem to have missed the deletion field twice! o_O
I’ll check it again!

I saw it in the debug log:

Aug 08 16:15:51 HOSTNAME filebeat[25031]: 
2019-08-08T16:15:51.128+0200 DEBUG [processors] processing/processors.go:108
Fail to apply processor global{drop_fields=offset, beat.name, input.type, prospector, beat.version, log.file.path}: key not found, key not found, key not found, key not found
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.