Filebeat: problem with logstash/elasticsearch (version 5.3.0)

Hi,

Filebeat service won't start if elasticsearch is not configured.

Below my configuration

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  enabled: false
  
#----------------------------- Logstash output --------------------------------
output.logstash:
  enabled: true

  # The Logstash hosts
  hosts: ["elastic.mynetwork.private:5044"]

Following the documentation, if logstash is enable, elasticsearch must be disabled.

But I've got this error:

root@universe:~# cat /var/log/filebeat/filebeat
2017-03-30T12:52:20+02:00 INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017-03-30T12:52:20+02:00 INFO Setup Beat: filebeat; Version: 5.3.0
2017-03-30T12:52:20+02:00 INFO Max Retries set to: 3
2017-03-30T12:52:20+02:00 INFO Activated logstash as output plugin.
2017-03-30T12:52:20+02:00 INFO Publisher name: **********
2017-03-30T12:52:20+02:00 INFO Flush Interval set to: 1s
2017-03-30T12:52:20+02:00 INFO Max Bulk Size set to: 2048
2017-03-30T12:52:20+02:00 INFO filebeat start running.
2017-03-30T12:52:20+02:00 INFO Total non-zero values:
2017-03-30T12:52:20+02:00 INFO Uptime: 6.113606ms
2017-03-30T12:52:20+02:00 INFO filebeat stopped.
2017-03-30T12:52:20+02:00 CRIT Exiting: Filebeat modules configured but the Elasticsearch output is not configured/enabled

It works with other beat (metricbeat at least, configured identically for output)

root@universe:~# cat /var/log/metricbeat/metricbeat
2017-03-30T12:59:23+02:00 INFO Home path: [/usr/share/metricbeat] Config path: [/etc/metricbeat] Data path: [/var/lib/metricbeat] Logs path: [/var/log/metricbeat]
2017-03-30T12:59:23+02:00 INFO Setup Beat: metricbeat; Version: 5.3.0
2017-03-30T12:59:23+02:00 INFO Max Retries set to: 3
2017-03-30T12:59:23+02:00 INFO Activated logstash as output plugin.
2017-03-30T12:59:23+02:00 INFO Publisher name: **********
2017-03-30T12:59:23+02:00 INFO Flush Interval set to: 1s
2017-03-30T12:59:23+02:00 INFO Max Bulk Size set to: 2048
2017-03-30T12:59:23+02:00 INFO Register [ModuleFactory:[docker, mongodb, mysql, postgresql, system], MetricSetFactory:[apache/status, ceph/cluster_disk, ceph/cluster_health, ceph/monitor_health, ceph/pool_disk, couchbase/bucket, couchbase/cluster, couchbase/node, docker/container, docker/cpu, docker/diskio, docker/healthcheck, docker/image, docker/info, docker/memory, docker/network, haproxy/info, haproxy/stat, kafka/consumergroup, kafka/partition, mongodb/dbstats, mongodb/status, mysql/status, nginx/stubstatus, php_fpm/pool, postgresql/activity, postgresql/bgwriter, postgresql/database, prometheus/collector, prometheus/stats, redis/info, redis/keyspace, system/core, system/cpu, system/diskio, system/filesystem, system/fsstat, system/load, system/memory, system/network, system/process, system/socket, zookeeper/mntr]]
2017-03-30T12:59:23+02:00 INFO metricbeat start running.

Thanks

The following message indicates that you have Filebeat modules enabled:

2017-03-30T12:52:20+02:00 CRIT Exiting: Filebeat modules configured but the Elasticsearch output is not configured/enabled 

Filebeat modules do not currently support using the Logstash output because they require ingest node, which is an Elasticsearch feature.

HI @dedemorton,

Thanks for the clarification. I was thinking that all "beats" support the same output ...

All beats support the same outputs, but when you use filebeat with the modules, elasticsearch is required.

This topic was automatically closed after 21 days. New replies are no longer allowed.