I'm trying to set up the filebeat system module to send logs to elastic through logstash. I'm following the filebeat "getting started" docs but the ingest pipeline that is created by the filebeat setup command is missing the property "timezone" : "{{ event.timezone }}",
and the documents are not being indexed as expected. Looking at the template it looks like it checks the var.convert_timezone setting which I have set to true in system.yml. These are the steps I'm following (from the guide):
-
edit filebeat.yml to output to logstash instead of elasticsearch
-
edit system.yml
syslog:
enabled: true
var.convert_timezone: trueauth:
enabled: true
var.convert_timezone: true -
restart filebeat
-
filebeat modules enable system
-
filebeat setup -e -E output.logstash.enabled=false -E output.elasticsearch.hosts=['localhost:9200'
-
filebeat setup --pipelines --modules system -E output.logstash.enabled=false -E output.elasticsearch.hosts=['localhost:9200']
the ingest pipeline created in elasticsearch does not have "timezone" : "{{ event.timezone }}"
"filebeat-7.0.1-system-syslog-pipeline" : {
"description" : "Pipeline for parsing Syslog messages.",
"processors" : [
{
"grok" : {
"field" : "message",
"patterns" : [
"""%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?: %{GREEDYMULTILINE:system.syslog.message}""",
"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{GREEDYMULTILINE:system.syslog.message}",
"""%{TIMESTAMP_ISO8601:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?: %{GREEDYMULTILINE:system.syslog.message}"""
],
"pattern_definitions" : {
"GREEDYMULTILINE" : "(.|\n)*"
},
"ignore_missing" : true
}
},
{
"remove" : {
"field" : "message"
}
},
{
"rename" : {
"field" : "system.syslog.message",
"target_field" : "message",
"ignore_missing" : true
}
},
{
"date" : {
"field" : "system.syslog.timestamp",
"target_field" : "@timestamp",
"formats" : [
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"yyyy-MM-dd'T'HH:mm:ss.SSSSSSZZ"
],
"ignore_failure" : true
}
},
{
"remove" : {
"field" : "system.syslog.timestamp"
}
}
],
"on_failure" : [
{
"set" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}
]
}
I managed to get this working previously using the filebeat setup commands, but I can not figure out the correct order or something to recreate it. Any ideas what I am missing?