Filebeat not starting in virtual environment

(Ishara Ruchiranga) #1

Hi we have built a tool to analyze our logs in our application. But when we try to start the Filebeat it just give the follow message and stop.

Please give me a solution

Also I tried in multiple filebeat versions. But no luck.

(Dominic Page) #2

Hi @Ishara_Ruchiranga

Please could you post your filebeat.yml


(Marco Basile) #3

Hello @Ishara_Ruchiranga, with your filebeat.yml file it would be easier to spot something. Keep in mind that filebeat is pretty peculiar with how you specify paths for file to scavenger, so it might be just a little mistake in how the path is written, for example, in Windows tha path of the file to read must be writtern with forward slashes ( "/" ) e not regular ones.
example: "C:/Users/username/Desktop/work_folder/log_folder/*/mylog.log"

(Ishara Ruchiranga) #5

Hi @Dominic_Page, Thanks for quick reply, Here is my filebeat.yml file

(Ishara Ruchiranga) #6

Hi @barcomasile, Thing is filebeat is working perfectly on my laptop and all other development pcs.

(Dominic Page) #7

hi @Ishara_Ruchiranga

try setting the output to

pretty: true

Does this generate any output to the console?

(Marco Basile) #8

Give a full path , not a relative one, for the log files to be scanned

(Ishara Ruchiranga) #9

@Dominic_Page Here is the output

(Ishara Ruchiranga) #10

Hi @barcomasile tried that also. No luck.

(Marco Basile) #11

So I don't actually see anything wrong with your configuration so I have a gyess:
you may try to remove the registry file which in linux is usually under "/var/lib/filebeat/registry.json", since it probably still keeping track of the files you want to scavenger, and that may be one reason for filebeat "not working".

Otherwise, I don't see why it shouldn't work. When you find out what was the problem, please let us know.

(Ishara Ruchiranga) #12

Hi @Dominic_Page Is it due to environment privileges issues once it is trying to get machine information since it is working fine with other environment which has more user privileges?

(Ishara Ruchiranga) #13

@Dominic_Page hey, It wil be really appreciate if you can give any idea about the issue.

(Dominic Page) #14

Hi @Ishara_Ruchiranga I took a look at the source and it looks like your issue occurs around the call to sysinfo.Host in beat.go . There have been some recent updates to go-windows. Could you try patching your filebeat to the latest version 6.4.3 ?

(Dominic Page) #15

I tried a similar configuration to yours, pointing to a directory where the account running Filebeat has no privileges. Filebeat ran normally, even though it could not read the configured directory.

(system) #16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.