Filebeat not reading logs from log files .Non-zero metrics in the last 30s

Elastic Stack Beats
1

Hi Team,

I am running filebeat in linux server , i have logstash 2.3 , Es 2.3 version and filebeat 6.2.0 version . Is this the issue with compatibility .

Filebeat config gives the log info as "Non-zero metrics in the last 30s" , it doesnt show any error also.

Can someone please show the path , where the error might be.

TIA

2

+add on to the question,

I have installed filebeat on 2 different servers, one in windows and other is on linux machine.

From windows filebeat i am able to parse/read the logs to centralized logstash(2.3.2 version), wherein i am not able to do the same from linux filebeat.

Both the servers i am using 6.2.0 version .

If the compatibility issue is there, then the windows filebeat also shouldn't work right?
Correct me if my understanding is wrong, and please do suggest what changes can i make.

TIA,

3

From the compatibility matrix point of view it seems not to be supported.

Could you please post your filebeat config to see if there are issues in the configuration itself?

Do you see anything in the elasticsearch log?

4

Config File :
filebeat.prospectors:

  • input_type: log

path:

  • /home/ext/filebeat_logs/server1/serverlogs.log
    multiline.pattern: '^[[:space:]]'
    multiline.negate: false
    multiline.match: after

output.logstash:
hosts: ["localhost:5044"]
logging.level: debug

i tested the config file ./filebeat -configtest -e,but it loks fine.

5

Yeah, but the 6.0 version filebeat is supporting in windows s/m and sending logs to logstash 2.3, but why is the same version is not supporting in linux m/c was my doubt.

6

Solved .

7

Could you let us know what caused the issue?

8

I was running in wrong method ,

Now i ran sudo dpkg -i filebeat and it worked

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.