Hi we have built a tool to analyze our logs in our application. But when we try to start the Filebeat it just give the follow message and stop.
Please give me a solution
EDIT:
Also I tried in multiple filebeat versions. But no luck.
Hello @Ishara_Ruchiranga, with your filebeat.yml file it would be easier to spot something. Keep in mind that filebeat is pretty peculiar with how you specify paths for file to scavenger, so it might be just a little mistake in how the path is written, for example, in Windows tha path of the file to read must be writtern with forward slashes ( "/" ) e not regular ones.
example: "C:/Users/username/Desktop/work_folder/log_folder/*/mylog.log"
Hi @Dominic_Page, Thanks for quick reply, Here is my filebeat.yml file
Hi @barcomasile, Thing is filebeat is working perfectly on my laptop and all other development pcs.
try setting the output to
output.console:
pretty: true
Does this generate any output to the console?
Give a full path , not a relative one, for the log files to be scanned
@Dominic_Page Here is the output
Hi @barcomasile tried that also. No luck.
So I don't actually see anything wrong with your configuration so I have a gyess:
you may try to remove the registry file which in linux is usually under "/var/lib/filebeat/registry.json", since it probably still keeping track of the files you want to scavenger, and that may be one reason for filebeat "not working".
Otherwise, I don't see why it shouldn't work. When you find out what was the problem, please let us know.
1 Like
Hi @Dominic_Page Is it due to environment privileges issues once it is trying to get machine information since it is working fine with other environment which has more user privileges?
@Dominic_Page hey, It wil be really appreciate if you can give any idea about the issue.
Hi @Ishara_Ruchiranga I took a look at the source and it looks like your issue occurs around the call to sysinfo.Host in beat.go . There have been some recent updates to go-windows. Could you try patching your filebeat to the latest version 6.4.3 https://www.elastic.co/downloads/beats/filebeat ?
I tried a similar configuration to yours, pointing to a directory where the account running Filebeat has no privileges. Filebeat ran normally, even though it could not read the configured directory.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.