Filebeat modules doesn't parse the logs

[rpendela (Ramesh Pendela)]

Hello Community,

I have installed filebeat and Nginx module is enabled

[root@ip-10-1-247-159 filebeat]# ./filebeat modules list
Enabled:
nginx

Filebeat templates are loaded manually.

I can see the logs in kibana UI but logs are not parsed yet all.

here is my filebeat configuration.

`filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: true
  reload.period: 30s

#================================ General ======================================

tags: ["webapp-staging"]
setup.template.enabled: false
#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts: ["logstash:5043", "logstash:5043", "logstash:5043"]
  bulk_max_size: 1024
  ssl.certificate_authorities: "/etc/filebeat/certs/ca.crt"
  ssl.certificate: "/etc/filebeat/certs/logstash-client.crt"
  ssl.key: "/etc/filebeat/certs/logstash-client.key"
  loadbalance: true


setup.kibana:
  host: "https://kibana:5601"
  username: "elastic"
  password: "password"
  ssl.certificate_authorities: "/etc/filebeat/certs/ca.crt"

#================================ Logging =====================================
logging.to_files: true
logging.files:
  path: /etc/filebeat/logs
logging.level: info
filebeat.registry_file: /etc/filebeat/.filebeat.yml


#============================== Xpack Monitoring ===============================

xpack.monitoring:
  enabled: True
  elasticsearch:
        hosts: ["https://elasticserach:9200", "https://elasticsearch:9200", "https://elasticsearch:9200"]
        username: logstash_system
        password: password
        ssl.ca: /etc/filebeat/certs/ca.crt`

I am not sure what I am missing here. Any thoughts and suggestions ?

[kvch (Noémi Ványi)]

In order to use Filebeat modules you need to send logs to Elasticsearch. Modules use the parsing capabilities of Ingest. In your case you are sending to Logstash instead of Elasticsearch, so parsing cannot be done.

If possible try sending your logs to ES. Otherwise, you can try converting the pipeline provided by the FB module using our conversion tool. https://www.elastic.co/guide/en/logstash/6.3/filebeat-modules.html