Filebeat only reads my local machine log files

[Amrbayoumy89 (Amr Bayoumy)]

Hello Dears,

I started to install Elasticsearch, Filebeat and Kibana on my local machine. I have a written text file for Tomcat logs called "tomcatServerlogs.log" and I entered its path in filebeat.yml

When I switch to Kibana I found that Filebeat only collects logs from my local machine and doesn't harvester tomcat logs. Please check the filebeat.yml configuration file and let me know the drawbacks.

In the tomcat log file there is a keyword "Response time out" and I want to filter by this exception. How can I add this to the configuration file?. example here below

[riferrei (Ricardo Ferreira)]

Hi Amr,

For Filebeat to be able to collect, parse correctly, and ship Tomcat logging, the Tomcat module needs to be enabled in the configuration. Here is more information about this module:

Tomcat module | Filebeat Reference [7.15] | Elastic

In your Filebeat configuration, there is a harvester configured to pull logs from two locations, but they won't necessarily parse it as Tomcat logs if the respective module is enabled. I recommend removing the Tomcat log configuration from the main Filebeat configuration and configuring it in the module — available at modules.d/tomcat.yml.

— @riferrei