Filebeat is not starting

Elastic Stack Beats
1

I am new to ELK stack and trying make it work. First I tried to configure filebeat to display syslog on Kibana and able to get through but when I tried to get DOCS logs, Filebeat failed to start.

Following is snippet of filebeat.yml file

- /var/log/secure

- /var/log/messages

      - /var/lib/mesos/slave/slaves/*/frameworks/*/executors/*/runs/latest/stdout

input_type: log
document_type: syslog
I am staring filebeat using following command on Linux box.
service filebeat start -v -d "*"
I really need you guys to help me out as I am really dead time line for this project. One more thing, where I can see filebeat log?

2

I am getting following error of consol

[ bin]# ./filebeat -e -c /etc/filebeat/filebeat.yml -v -d "*"
Loading config file error: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: line 73: did not find expected key. Exiting.

and on line 73, I have document_type: syslog

3

service filebeat start -v -d "*"

The service command doesn't take arguments like above. How you configure the startup arguments depends on things like whether your OS uses systemd, whether you have an init script, what it looks like, etc.

One more thing, where I can see filebeat log?

See Configure logging | Filebeat Reference [8.11] | Elastic.

Loading config file error: YAML config parsing failed on /etc/filebeat/filebeat.yml: yaml: line 73: did not find expected key. Exiting.

Impossible to tell what's wrong without seeing the whole file. When you post it, make sure you format it as code with the </> button.

4

Thank you so much for your reply.
After removing the document_type = syslog indent preformatted text by 4 spacesfrom filebeat.yml , it started without error indent preformatted text by 4 spacesand able to see the log on Kibana. But I don't understand why it's causing this issue as I have the filter configuration corresponding to syslog on my logstash file which is as follow
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
indent preformatted text by 4 spaces

5

As I said: Impossible to tell what's wrong without seeing the whole file.

6

Thanks again.actually it was formatting issue in filebeat.yml file.It's working now,

7

This topic was automatically closed after 21 days. New replies are no longer allowed.