Filebeat Logstash Multiple Index error

Elastic Stack Beats
1

Why this config is not creating indexes in Kibana for Filebeat Logstash Multiple Indexes. Using 7.1.1 version

filebeat.yml

#=========================== Filebeat inputs =============================

filebeat.inputs:

  • type: log

    enabled: true
    paths:

    • c:\elk-stack\data_files\data*.log
      fields:
      type: "data"

  • type: log
    enabled: true
    paths:

    • c:\elk-stack\data_files\winemag*.log
      fields:
      type: "winemagservice"

#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["localhost:5044"]
index: "index-%{[fields.type]:other}"

logstash.conf

input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}

2

Hi @rvjagadheesh and welcome to the Elastic community.

Could you please post your Filebeat log here? Maybe that will give us a clue as to what's going on. Please be sure to mask any sensitive information in the log before posting it.

Also, could you try to temporarily disable the Logstash output in filebeat and use the Console output instead, just for debugging purposes? This will at least tell us if the issue is somewhere on the Filebeat side or the Logstash side.

Thanks,

Shaunak

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.