Filebeat is not monitoring logs on centos 7?

Elastic Stack Beats
16

Having 2 outputs creates some indirect coupling. If one output is blocked, log-lines can not be ACKed and internal queues will run fill without publishing any new events to any output. In 6.0.0-beta1 we removed the ability to configure multiple outputs.

Unfortunately I find it quite hard to follow/understand your setup and things your changing here and there. We're having a getting started guide for filebeat, but just from reading some other blog-post I can not tell anything about all components being setup correctly.

Let's start over with the most simples configuration and verify filebeat->logstash configuration only for now. We're going to add the other components (TLS, logstash filters, elasticsearch output, kibana) in the next steps.

Let's start with filebeat and logstash running on the same machine. For filebeat use:

filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/messages
filebeat.registry_file: /var/lib/filebeat/registry

output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

and for logstash use:

input {
  beats { 
    port => 5044
  }
}

output {
    stdout { codec => rubydebug }
}

This will configure filebeat to forward the logs to logstash and logstash will outputs events (without modifying them) to stdout.

Delete the registry file in filebeat between each run.

The test should forward only log file for now. Check the events being written (check registry) matches the actual file size.

Once this works, use the same filebeat configuration on the remote host.

For each host/test, please post the host/OS name of the filebeat machine (local vs. remote will do) + output of wc /var/log/messages and the registry file. If something went wrong (ERR,WARN messages in filebeat or logstash), also attach the logs.