Filebeat in windows 2008 r2 - not sending data to logstash

Elastic Stack Beats
1

Hello,

I installed filebeat 1.0.1 in my windows 2008 r2 server. I have configured the below path and logstash server output

  paths:
    - C:\Documentum\dba\*.log

logstash:
# The Logstash hosts
hosts: ["10.10.10.15:5044"]

Port 5044 is open in my logstash server 10.10.10.15 and one of my linux client where I have installed filebeat is behaving well and sending data to the same logstash server. I also checked to make sure there are no unwanted tab space in the yml file.

This is the output that I get when running filebeat in -v mode.

PS C:\Program Files\Filebeat> .\filebeat.exe -c filebeat.yml -e -v
2016/01/22 12:41:15.359008 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths
2016/01/22 12:41:15.361938 outputs.go:111: INFO Activated logstash as output plugin.
2016/01/22 12:41:15.362915 publish.go:249: INFO Publisher name: ARM-RD-W8X-D671
2016/01/22 12:41:15.367799 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1
2016/01/22 12:41:15.369753 beat.go:133: INFO filebeat sucessfully setup. Start running.
2016/01/22 12:41:15.370730 registrar.go:66: INFO Registry file set to: C:\ProgramData\filebeat\registry
2016/01/22 12:41:15.371706 registrar.go:76: INFO Loading registrar data from C:\ProgramData\filebeat\registry
2016/01/22 12:41:15.372683 spooler.go:77: INFO Starting spooler: spool_size: 1024; idle_timeout: 5s
2016/01/22 12:41:15.373660 crawler.go:78: INFO All prospectors initialised with 0 states to persist
2016/01/22 12:41:15.373660 registrar.go:83: INFO Starting Registrar
2016/01/22 12:41:15.374637 filebeat.go:122: INFO Start sending events to output

Filebeat log files are also not generated. Could you please let me know what could be wrong?

Thanks,
Vishnu

2

Sorry, it was my mistake. filebeat was running fine. But the path was wrong, so I did not see expected communication between the filebeat host and logstash server.

But I still dont know why I am not seeing filebeat log files in C:\ProgramData\filebeat\Logs

3

Filebeat log files are also not generated. Could you please let me know what could be wrong?

What does your Filebeat command line look like?

4

.\filebeat.exe -c filebeat.yml -e -v -d "*"

I tried this and filebeat is sending data to my logstash server. The logs are not created even when I start filebeat from services.

5

That indicates that your filebeat.yml doesn't configure logging properly. See https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#configuration-logging for details.