Filebeat/module nginx ; problem with permissions

[Gounlaf]

Hi,

I updated filebeat to version 5.3.0 on a linux server (Ubuntu 16.04 LTS).
I wanted to enable the module nginx; but I got an this error (when executing filebeat as a service).

2017-03-30T11:41:38+02:00 INFO Metrics logging every 30s
2017-03-30T11:41:38+02:00 INFO Flush Interval set to: 1s
2017-03-30T11:41:38+02:00 INFO Max Bulk Size set to: 2048
2017-03-30T11:41:38+02:00 CRIT Exiting: Error reading fileset nginx/access: Error reading manifest file: config file ("/usr/share/filebeat/module/nginx/access/manifest.yml") can only be writable by the owner but the permissions are "-rw-rw-r--" (to fix the permissions use: 'chmod go-w /usr/share/filebeat/module/nginx/access/manifest.yml')

Changing permissions doesn't solve the problem.

I'm "noob" with ELK ; I installed version 5.2.0 first ( I was "waiting" for nginx module before going deeper in configuration).
So I uninstalled filebeat package and reinstalled it. But it doesn't work better.

If I execute filebeat manually, the problem doesn't happen (I'm not sure since it's really verbose)

/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -e -d "*"

Below the filebeat.yml (condensed, comments dropped ; it seems that there is mistake in tutorial, where it's "name" key instead of "module" )

filebeat.modules:
- module: nginx
  access:
    enabled: true
  error:
    enabled: true
filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/*.log

output.elasticsearch:
  enabled: false
output.logstash:
  enabled: true

If you need more informations / tests, ask me.

Thanks.

[exekias (Carlos Pérez Aradros)]

Hi @Gounlaf,

Can you please share the output of running ls -la /usr/share/filebeat/module/nginx/access/?

Also I think you are right on the tutorial, thank you for the report, I'll open an issue to fix it!

[Gounlaf]

Hi @exekias,

Output below (I don't have remove w permission for group ; I've done it before re-installing the package):

root@universe:/var/log/filebeat# ls -la /usr/share/filebeat/module/nginx/access/
total 20
drwxrwxr-x 4 root root 4096 mars  30 10:04 .
drwxrwxr-x 4 root root 4096 mars  30 10:04 ..
drwxrwxr-x 2 root root 4096 mars  30 10:04 config
drwxrwxr-x 2 root root 4096 mars  30 10:04 ingest
-rw-rw-r-- 1 root root  395 mars  23 04:09 manifest.yml

Edit: about the tutorial

• I've encoutered another problem: It seems that the "var.paths" config key has a wrong syntax. Copy/past the one given in tutorial doesn't work and complain about "list format". But if i'm right, the documentation about conf files "validate" the tutorial.

• The path is linked to apache2, not nginx

[exekias (Carlos Pérez Aradros)]

The file has wrong permissions. What happens if you run this and then try to launch filebeat again?:

chmod go-w /usr/share/filebeat/module/nginx/access/manifest.yml
ls -la /usr/share/filebeat/module/nginx/access/

I've created a ticket to fix the documentation, feel free to update it with any new findings: https://github.com/elastic/beats/issues/3857

[Gounlaf]

Oh well, my bad ; it's works.
I've had to fix permission on access and error manifest.

I was doing it on access manifest only ... my mistake.

=> So, yes, It works now.

Btw, filebeat is installed throw apt repository. I've not compiled myself, neither downloaded a .deb manually ; and I didn't touch permissions.

Thanks for the documentation ticket.

[exekias (Carlos Pérez Aradros)]

Good you have it working, uhm I'll review that also, may be a packaging problem

Thank you for reporting it!