Filebeat have harvested logs and got a connection to logstash, yet they don't show up on kibana

Hello,
as can be seen on my error below I've established a connection and have harvested a log file (the log file isn't empty)

Yet when I'm looking at kibana I cannot see the log from filebeat (the name serviceportal is supposed to appear)

This is my filebeat.yml:

logging.level: debug

filebeat.inputs:

- type: log
  paths:
  - /data/wildfly/serviceportal/standalone/log/*.log
  fields:
    service: serviceportal
    environment: preprod
    logtype: wildfly-default
    timezone: CET
    host: moby-srpv-web01
  multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after


name: "filebeat-web01"
tags: ["preprod", "web01", "serviceportal"]

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

output.logstash:
  hosts: ["10.52.2.13:5044"]
  index: filebeat_logs

I'm using version 7.1.1 of kibana, ES, logstash and filebeat which am I running as a docker container

Please format configuration files and logs using the </> button. Also post logs as text and not as images, not everyone will be able to read your images.

Filebeat is sending events, but from metrics it looks like logstash didn't ACK those events yet, which blocks filebeat. Check your logstash config/logs.

1 Like

Thanks steffens, there wasn't enough space for logstash. I\ve pruned some space on the enviroment and it works now

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.