Filebeat log stdout logstash

Elastic Stack Logstash
1

I'm relatively new to ELK and currently trying to go through this article and I'm trying to just look at the stdout in the logstash console however it doesn't seem to be working.

My filebeat.yml config is on the squid server is

filebeat.inputs:
  - type: log
  enabled: true
  paths:
    - /var/log/squid/access.log

output.logstash:
  hosts: ["logstash:5044"]

The pipeline config is as follows on the logstash server

input {
  beats {
    port => "5044"
  }
}
output {
  stdout { codec => rubydebug }
}

Looking at the following guide, it should be relatively straight forward
https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html and I should be seeing the output on the logstash console, however there's nothing, I'm not sure what i might be missing?

Any pointers?

2

Are you running both the logstash and filebeat as services on the systems?

I would recommend for testing to stop the services that are running and use commands to test. That way you can see errors as they arise.

The command I run to start logstash for testing is:

/usr/share/logstash/bin/logstash --config.reload.automatic --path.settings=/etc/logstash

And the command I use for filebeats is:

/usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -d "publish"

When I first started, I had a problem with open ports on my logstash server, so my filebeats server kept popping up an error message that it could not connect. So the goal here is to figure out what errors are popping up.

3

Thanks for the tip, I was running them both as services.
Stopped the services and then was able to run the commands for both filebeats and logstash, can also see the stdout on the console.

All working as expected now.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.