Filebeat in windows 2008 r2 - not sending data to logstash

(Vishnudev K S) #1


I installed filebeat 1.0.1 in my windows 2008 r2 server. I have configured the below path and logstash server output

    - C:\Documentum\dba\*.log

# The Logstash hosts
hosts: [""]

Port 5044 is open in my logstash server and one of my linux client where I have installed filebeat is behaving well and sending data to the same logstash server. I also checked to make sure there are no unwanted tab space in the yml file.

This is the output that I get when running filebeat in -v mode.

PS C:\Program Files\Filebeat> .\filebeat.exe -c filebeat.yml -e -v
2016/01/22 12:41:15.359008 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths
2016/01/22 12:41:15.361938 outputs.go:111: INFO Activated logstash as output plugin.
2016/01/22 12:41:15.362915 publish.go:249: INFO Publisher name: ARM-RD-W8X-D671
2016/01/22 12:41:15.367799 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1
2016/01/22 12:41:15.369753 beat.go:133: INFO filebeat sucessfully setup. Start running.
2016/01/22 12:41:15.370730 registrar.go:66: INFO Registry file set to: C:\ProgramData\filebeat\registry
2016/01/22 12:41:15.371706 registrar.go:76: INFO Loading registrar data from C:\ProgramData\filebeat\registry
2016/01/22 12:41:15.372683 spooler.go:77: INFO Starting spooler: spool_size: 1024; idle_timeout: 5s
2016/01/22 12:41:15.373660 crawler.go:78: INFO All prospectors initialised with 0 states to persist
2016/01/22 12:41:15.373660 registrar.go:83: INFO Starting Registrar
2016/01/22 12:41:15.374637 filebeat.go:122: INFO Start sending events to output

Filebeat log files are also not generated. Could you please let me know what could be wrong?


(Vishnudev K S) #2

Sorry, it was my mistake. filebeat was running fine. But the path was wrong, so I did not see expected communication between the filebeat host and logstash server.

But I still dont know why I am not seeing filebeat log files in C:\ProgramData\filebeat\Logs

(Magnus Bäck) #3

Filebeat log files are also not generated. Could you please let me know what could be wrong?

What does your Filebeat command line look like?

(Vishnudev K S) #4

.\filebeat.exe -c filebeat.yml -e -v -d "*"

I tried this and filebeat is sending data to my logstash server. The logs are not created even when I start filebeat from services.

(Magnus Bäck) #5

That indicates that your filebeat.yml doesn't configure logging properly. See for details.

(system) #6