Filebeat Mysql Module dashboard - No results found

[Milad_Hamid]

Hi,

I installed Filebeat 6.2 and enabled Mysql module to monitor our MariaDB / Mysql server. I configured filebeat.yml and mysql.yml as following:

filebeat.yml

filebeat.prospectors:

- type: log
  fields.logtype: "MariaDBerror"
  enabled: true
  paths:
    - C:\Program Files\MariaDB 10.2\data\LAPTOP-milad-slow.log
    - C:\Program Files\MariaDB 10.2\data\LAPTOP-milad.err
  multiline.pattern: '^\#####'
  multiline.negate: true
  multiline.match: after
#============================= Filebeat modules ===============================
filebeat.config.modules:
  #path: ${path.config}/modules.d/*.yml
  path: C:\ProgramData\Elastic\filebeat\modules.d\mysql.yml
  reload.enabled: true
#==================== Elasticsearch template setting ==========================
setup.template.settings:
    index.number_of_shards: 3
#============================== Dashboards =====================================
setup.dashboards.enabled: true
#============================== Kibana =====================================
setup.kibana:
  host: "localhost:5601"
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
   hosts: ["localhost:9200"]

filebeat\modules.d\mysql.yml

- module: mysql
  # Error logs
  error:
    enabled: true
    var.paths: 'C:\Program Files\MariaDB 10.2\data\LAPTOP-milad.err'
    
  # Slow logs
  slowlog:
    enabled: true
    var.paths: 'C:\Program Files\MariaDB 10.2\data\LAPTOP-milad-slow.log'

So in Kibana when i open Filebeat Mysql Overview dashboard it shows no results found.
I got events in discover page so my filebeat sending logs to the elasticsearch and i see them in discover page.

I used http://www.yamllint.com/ to check errors with mysql.yml file, and it seems ok.

Appreciate help with this.

[jsoriano (Jaime Soriano)]

Hi @Milad_Hamid,

Indeed if the logs appear in the discovery page they should also appear in the dashboards. Can you check if the logs you see in discover are the ones created by mysql filebeat module? (They should have the fileset.name field set to mysql).

[Milad_Hamid]

Hi @jsoriano and thanks for reply.

@jsoriano

Can you check if the logs you see in discover are the ones created by mysql filebeat module? (They should have the fileset.name field set to mysql).

I need your help with this how i can check if it is created by Mysql Module ? because what i am seeing now in elasticsearch the default filebeat index. So i don't know if logs in discover created by filebeat mysql module!

but in Powershell i tried ./filebeat -e then shut down the MySQL server to get some logs, so i could see this error show up in Powershell by running ./filebeat -e :

2018-05-15T15:16:51.252+0200 ERROR cfgfile/reload.go:206 Unable to create runner due to error: Error getting config for fielset mysql/error: Error interpreting the template of the prospector: template: text:3:22: executing "text" at <.paths>: range can't iterate over C:\Program Files\MariaDB 10.2\data\LAPTOP-milad.err

[jsoriano (Jaime Soriano)]

Oh, I see in the error, var.paths must be set as an array, try this configuration:

- module: mysql
  # Error logs
  error:
    enabled: true
    var.paths:
      - 'C:\Program Files\MariaDB 10.2\data\LAPTOP-milad.err'
    
  # Slow logs
  slowlog:
    enabled: true
    var.paths:
      - 'C:\Program Files\MariaDB 10.2\data\LAPTOP-milad-slow.log'

[Milad_Hamid]

Thanks , i will test it and post the feedback.

[Milad_Hamid]

@jsoriano yes that was the solution and in addition i stopped running ./filebeat -e in Powershell because i think it will reload the module, so it works
Thank you