Hi, I am trying to send log from one server to logstash server. But, I found that, log is being sent from other location. What did I miss?
filebeat.yml
######################Filebeat Configuration Example #########################
#This file is an example configuration file highlighting only the most common
#options. The filebeat.reference.yml file from the same directory contains all the
#supported options with more comments. You can use it as a reference.
#You can find the full configuration reference here:
#https://www.elastic.co/guide/en/beats/filebeat/index.html
#For more available modules and options, please see the filebeat.reference.yml sample
#configuration file.
#=========================== Filebeat inputs =============================
filebeat.inputs:
#Each - is an input. Most options can be set at the input level, so
#you can use different inputs for various configurations.
#Below are the input specific configurations.
-
type: log
#Change to true to enable this input configuration.
enabled: true#Paths that should be crawled and fetched. Glob based paths.
paths:- /var/log/custom_log/mxtracelog.log
#- /var/log/httpd/access_log
#- /var/log/apache-logs/*
#- /var/log/apache/abc.log
#- /var/log/zabbix/zabbix_server.log
#- /data/pgsql/9.6/data/pg_log/*
#- c:\programdata\elasticsearch\logs*
#Exclude lines. A list of regular expressions to match. It drops the lines that are
#matching any regular expression from the list.
#exclude_lines: ['^DBG']#Include lines. A list of regular expressions to match. It exports the lines that are
#matching any regular expression from the list.
#include_lines: ['^ERR', '^WARN']#Exclude files. A list of regular expressions to match. Filebeat drops the files that
#are matching any regular expression from the list. By default, no files are dropped.
#exclude_files: ['.gz$']#Optional additional fields. These fields can be freely picked
#to add additional information to the crawled log files for filtering
#fields:
#level: debug
#review: 1###Multiline options
#Multiline can be used for log messages spanning multiple lines. This is common
#for Java Stack Traces or C-Line Continuation#The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
#multiline.pattern: ^[#Defines if the pattern set under pattern should be negated or not. Default is false.
#multiline.negate: false#Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
#that was (not) matched before or after or as long as a pattern is not matched based on negate.
#Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
#multiline.match: after - /var/log/custom_log/mxtracelog.log
#================================ General =====================================
#The name of the shipper that publishes the network data. It can be used to group
#all the transactions sent by a single shipper in the web interface.
#name:
#name:
#The tags of the shipper are included in their own field with each
#transaction published.
#tags: ["service-X", "web-tier"]
tags: ["mxtrace-log"]
#Optional fields that you can specify to add additional information to the
#output.
#fields:
#env: staging
#============================== Kibana =====================================
#Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
#This requires a Kibana endpoint configuration.
setup.kibana:
#Kibana Host
#Scheme and port can be left out and will be set to the default (http and 5601)
#In case you specify and additional path, the scheme is required: http://localhost:5601/path
#IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
host: "elk.devops-bjit.com:5601"
#Kibana Space ID
#ID of the Kibana Space into which the dashboards should be loaded. By default,
#the Default Space will be used.
#space.id:
#================================ Outputs =====================================
#Configure what output to use when sending the data collected by the beat.
#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
#Array of hosts to connect to.
#hosts: ["localhost:9200"]
#Optional protocol and basic auth credentials.
#protocol: "https"
#username: "elastic"
#password: "changeme"
#----------------------------- Logstash output --------------------------------
output.logstash:
#The Logstash hosts
hosts: ["elk.devops-bjit.com:5044"]
#Optional SSL. By default is off.
#List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
#Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
#Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#================================ Processors =====================================
#Configure processors to enhance or manipulate events generated by the beat.
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
#================================ Logging =====================================
#Sets log level. The default log level is info.
#Available log levels are: error, warning, info, debug
#logging.level: debug
#At debug level, you can selectively enable logging only for some components.
#To enable all selectors use [""]. Examples of other selectors are "beat",
#"publish", "service".
#logging.selectors: [""]
#============================== Xpack Monitoring ===============================
#filebeat can export internal metrics to a central Elasticsearch monitoring
#cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
#reporting is disabled by default.
#Set to true to enable the monitoring reporter.
#xpack.monitoring.enabled: false
#Uncomment to send the metrics to Elasticsearch. Most settings from the
#Elasticsearch output are accepted here as well. Any setting that is not set is
#automatically inherited from the Elasticsearch output configuration, so if you
#have the Elasticsearch output configured, you can simply uncomment the
#following line.
#xpack.monitoring.elasticsearch:
#================================= Migration ==================================
#This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true
But from Kibana, I am finding this path.
Can you please, help?