Filebeat-god stopped


(ELK Explorer) #1

Hello All,
I am using filebeat to access one simple log file.

filebeat.yml :-

filebeat.inputs:
type: log
enabled: true
paths:
- /var/log/nandan.log
output.elasticsearch:
hosts: ["10.10.1.5:9200"]

nandan.log file data is :-

Jul 09 02:43:51 Installed: elasticsearch-6.3.1-1.noarch
Jul 09 03:03:14 Installed: 1:logstash-6.3.1-1.noarch
Jul 09 03:10:31 Installed: kibana-6.3.1-1.x86_64
Jul 09 03:34:28 Erased: elasticsearch
Jul 09 03:37:25 Installed: elasticsearch-6.3.1-1.noarch
Jul 09 05:21:48 Erased: elasticsearch
Jul 09 05:21:57 Erased: kibana
Jul 09 05:22:13 Erased: logstash
Jul 10 02:09:32 Installed: elasticsearch-6.3.1-1.noarch
Jul 10 02:52:42 Installed: kibana-6.3.1-1.x86_64

I ran the command

[root@DSE4-1 filebeat]# sudo service filebeat start

Got error as :-

[root@DSE4-1 filebeat]# sudo service filebeat start
Starting filebeat: 2018-07-10T03:41:14.231-0400 INFO instance/beat.go:492 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2018-07-10T03:41:14.234-0400 INFO instance/beat.go:499 Beat UUID: 1713f042-12be-48e8-98ba-449d5a95f22f
2018-07-10T03:41:14.235-0400 INFO [beat] instance/beat.go:716 Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "1713f042-12be-48e8-98ba-449d5a95f22f"}}}
2018-07-10T03:41:14.235-0400 INFO [beat] instance/beat.go:725 Build info {"system_info": {"build": {"commit": "ed42bb85e72ae58cc09748dc1825159713e0ffd4", "libbeat": "6.3.1", "time": "2018-06-29T21:09:35.000Z", "version": "6.3.1"}}}
2018-07-10T03:41:14.235-0400 INFO [beat] instance/beat.go:728 Go runtime info {"system_info": {"go": {"os":"linux","arch":"amd64","max_procs":4,"version":"go1.9.4"}}}
2018-07-10T03:41:14.236-0400 INFO [beat] instance/beat.go:732 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2018-05-07T00:45:45-04:00","containerized":true,"hostname":"DSE4-1","ips":["127.0.0.1/8","172.16.101.107/16","10.172.16.107/24"],"kernel_version":"2.6.32-696.1.1.el6.x86_64","mac_addresses":["3e:37:bd:b1:7d:2b","62:e7:df:a5:47:65"],"os":{"family":"redhat","platform":"centos","name":"CentOS","version":"6.9 (Final)","major":6,"minor":9,"patch":0,"codename":"Final"},"timezone":"EDT","timezone_offset_sec":-14400}}}
2018-07-10T03:41:14.236-0400 INFO [beat] instance/beat.go:761 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","38","39","40","41","42","43","44","45","46","47","48","49","50","51","52","53","54","55","56","57","58","59","60","61","62","63"],"ambient":null}, "cwd": "/", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 15194, "ppid": 15193, "seccomp": {"mode":""}, "start_time": "2018-07-10T03:41:14.100-0400"}}}
2018-07-10T03:41:14.236-0400 INFO instance/beat.go:225 Setup Beat: filebeat; Version: 6.3.1
2018-07-10T03:41:14.236-0400 INFO elasticsearch/client.go:145 Elasticsearch url: http://172.16.101.107:9200
2018-07-10T03:41:14.237-0400 INFO pipeline/module.go:81 Beat name: DSE4-1
2018-07-10T03:41:14.237-0400 ERROR instance/beat.go:691 Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?
Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?

I tried to check filebeat log location but there are no any folder as filebeat in /var/log location..

and idea, what's the issue and how to resolve.
Thanks


(Carlos PĂ©rez Aradros) #2

Hi @nandan_bigdata,

The error message says that no module or input is enabled. I see you have an input in your pasted config, but indenting is gone after pasting.

It looks like filebeat.inputs is not a list, as - is missing, but I'm not sure

Can you paste your configuration again using the performatted text button to format it?

Best regards


(ELK Explorer) #3

It's solved.. I checked my configuration file and resolved it.
Thanks


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.