Filebeat not starting in virtual environment

[Ishara_Ruchiranga]

Hi we have built a tool to analyze our logs in our application. But when we try to start the Filebeat it just give the follow message and stop.

Please give me a solution

EDIT:
Also I tried in multiple filebeat versions. But no luck.

[Dominic_Page]

Hi @Ishara_Ruchiranga

Please could you post your filebeat.yml

thanks!

[barcomasile (Marco Basile)]

Hello @Ishara_Ruchiranga, with your filebeat.yml file it would be easier to spot something. Keep in mind that filebeat is pretty peculiar with how you specify paths for file to scavenger, so it might be just a little mistake in how the path is written, for example, in Windows tha path of the file to read must be writtern with forward slashes ( "/" ) e not regular ones.
example: "C:/Users/username/Desktop/work_folder/log_folder/*/mylog.log"

[Ishara_Ruchiranga]

Hi @Dominic_Page, Thanks for quick reply, Here is my filebeat.yml file

[Ishara_Ruchiranga]

Hi @barcomasile, Thing is filebeat is working perfectly on my laptop and all other development pcs.

[Dominic_Page]

hi @Ishara_Ruchiranga

try setting the output to

output.console:
pretty: true

Does this generate any output to the console?

[barcomasile (Marco Basile)]

Give a full path , not a relative one, for the log files to be scanned

[Ishara_Ruchiranga]

@Dominic_Page Here is the output

[Ishara_Ruchiranga]

Hi @barcomasile tried that also. No luck.

[barcomasile (Marco Basile)]

So I don't actually see anything wrong with your configuration so I have a gyess:
you may try to remove the registry file which in linux is usually under "/var/lib/filebeat/registry.json", since it probably still keeping track of the files you want to scavenger, and that may be one reason for filebeat "not working".

Otherwise, I don't see why it shouldn't work. When you find out what was the problem, please let us know.

[Ishara_Ruchiranga]

Hi @Dominic_Page Is it due to environment privileges issues once it is trying to get machine information since it is working fine with other environment which has more user privileges?

[Ishara_Ruchiranga]

@Dominic_Page hey, It wil be really appreciate if you can give any idea about the issue.

[Dominic_Page]

Hi @Ishara_Ruchiranga I took a look at the source and it looks like your issue occurs around the call to sysinfo.Host in beat.go . There have been some recent updates to go-windows. Could you try patching your filebeat to the latest version 6.4.3 https://www.elastic.co/downloads/beats/filebeat ?

[Dominic_Page]

I tried a similar configuration to yours, pointing to a directory where the account running Filebeat has no privileges. Filebeat ran normally, even though it could not read the configured directory.