Filebeat not sending output

Elastic Stack Beats
1

I was trying to debug why my filebeat is not sending output to kafka but after debuging I'd change it to file output to see if my config is ok, but Im not getting any output also

This is my config file

cat filebeat.yml|grep -v "#" |grep -v  ^$
filebeat.inputs:
- type: log
  paths:
    - /tmp/example.log
  json_keys_under_root: true
  json.add_error_key: true
- type: log
  enabled: false
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
output.file:
  enabled: true
  codec.json:
    pretty: true
  path: "/tmp/fbeat.log"
  hosts: ["localhost:9200"]
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
logging.level: warning
logging.selectors: ["*"]

Im sending logs to the input file /tmp/example.log as JSON

{
"error": "dial tcp 172.21.0.2:5432: getsockopt: connection refused",
"level": "error",
"msg": "Could not open database connection",
"time": "2020-03-27T16:40:49Z"
}

In this way (just testing)

echo -n '{"error":"dial tcp 172.21.0.2:5432: getsockopt: connection refused","level":"error","msg":"Could not open database connection","time":"2020-03-27T16:40:49Z"}' >> /tmp/example.log

And I cant get the output file /tmp/fbeat.log

While If I send the output to console I see that filebeat is parsing the input file

{

"@timestamp": "2020-09-10T12:00:16.789Z",
"@metadata": {
"beat": "filebeat",
"type": "_doc",
"version": "7.9.1"
},
"log": {
"offset": 1272,
"file": {
"path": "/tmp/example.log"
}
},
"json": {
"msg": "Could not open database connection",
"time": "2020-08-27T16:36:49Z",
"error": "dial tcp 172.21.0.2:5432: getsockopt: connection refused",
"level": "error"
},
.....
}

Any ideas? Thanks in advance

2

I performed some changes in the output.file stanza, but same results

output.file:
  enabled: true
  codec.json:
    pretty: true
  path: "/tmp"
  filename: filebeat
3

My bad. I was sending the info to the log in a wrong way.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.