I can't seem to get filebeat to send the logs to logstash. I'm trying to set up the elk stack on a remote ssh and visualize the logs in kibana. I've read some of the other posts, but still can't figure out the error. I have posted my filebeat.yml > filebeat.prospectors: - input_type: log paths:…

ah, interesting, now when I try to restart filebeat...it throws an error loading the yaml: line 104: did not find expected key. But, I've commented out this section... output.logstash: # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certifica…

Do these need to match my logstash.conf inputs? I re edited my original post with my current logstash.conf

[image] kmrychl: error loading the yaml: line 104: did not find expected key I don't see where you defined hosts: [xxx]. That's probably what it's complaining about with that error. And you have commented out the ssl.certificate and ssl.key. Those will be needed since force_peer is used in L…

Would this be correct? output.logstash: # The Logstash hosts hosts: ["elkserver:5044"] bulk_max_size: 1024 # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.cr…

No. It's a YAML configuration file and in YAML indentation is very important. output.logstash: hosts: ["elkserver:5044"] bulk_max_size: 1024 ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] ssl.certificate: "/etc/pki/tls/certs/filebeat.crt" ssl.key: "/etc/pki/tls…

Thanks, but it is still throwing an error. No events are being published

Please repost the complete configuration file. The </> button to format it.

logstash.conf input { beats { port => 5044 ssl => true # enable TLS/SSL # configure logstash server certificate being presented to filebeat ssl_certificate => "/etc/pki/tls/certs/logstash.crt" ssl_key => "/etc/pki/tls/private/logstash.key" # configure client auth + file…

The logging configuration is invalid due to indentation. There is a example provided with the beat in filebeat.full.yml that shows the correct indentation. logging.files: path: /var/log/mybeat name: mybeat.log keepfiles: 7

What's in the Filebeat log file?

Discuss the Elastic Stack

Filebeat not fowarding to Logstash

Elastic Stack Beats

ruflin (ruflin) February 21, 2017, 8:04am 22

How did you install Logstash?

Topic		Replies	Views
Filebeat logs not making it to Logstash Beats filebeat	5	5692	December 11, 2020
Configuring filebeat to send specified logs to E.L.K server's logstash HELP! Beats filebeat	16	12884	July 5, 2017
Can't start filebeat with TLS configured Beats filebeat	19	13635	July 5, 2017
Filebeat is not monitoring logs on centos 7? Beats filebeat	22	6859	August 25, 2017
Configure Filebeat for All Logs Beats filebeat	35	15644	July 5, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Filebeat not fowarding to Logstash

Related topics