Filebeat modules doesn't parse the logs

Elastic Stack Beats
1

Hello Community,

I have installed filebeat and Nginx module is enabled

[root@ip-10-1-247-159 filebeat]# ./filebeat modules list
Enabled:
nginx

Filebeat templates are loaded manually.

I can see the logs in kibana UI but logs are not parsed yet all.

here is my filebeat configuration.

`filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: true
  reload.period: 30s

#================================ General ======================================

tags: ["webapp-staging"]
setup.template.enabled: false
#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts: ["logstash:5043", "logstash:5043", "logstash:5043"]
  bulk_max_size: 1024
  ssl.certificate_authorities: "/etc/filebeat/certs/ca.crt"
  ssl.certificate: "/etc/filebeat/certs/logstash-client.crt"
  ssl.key: "/etc/filebeat/certs/logstash-client.key"
  loadbalance: true


setup.kibana:
  host: "https://kibana:5601"
  username: "elastic"
  password: "password"
  ssl.certificate_authorities: "/etc/filebeat/certs/ca.crt"

#================================ Logging =====================================
logging.to_files: true
logging.files:
  path: /etc/filebeat/logs
logging.level: info
filebeat.registry_file: /etc/filebeat/.filebeat.yml


#============================== Xpack Monitoring ===============================

xpack.monitoring:
  enabled: True
  elasticsearch:
        hosts: ["https://elasticserach:9200", "https://elasticsearch:9200", "https://elasticsearch:9200"]
        username: logstash_system
        password: password
        ssl.ca: /etc/filebeat/certs/ca.crt`

I am not sure what I am missing here. Any thoughts and suggestions ?

2

In order to use Filebeat modules you need to send logs to Elasticsearch. Modules use the parsing capabilities of Ingest. In your case you are sending to Logstash instead of Elasticsearch, so parsing cannot be done.

If possible try sending your logs to ES. Otherwise, you can try converting the pipeline provided by the FB module using our conversion tool. https://www.elastic.co/guide/en/logstash/6.3/filebeat-modules.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.