Filebeat registry data.json is empty

Elastic Stack Beats
1

I am trying to setup filebeat, but it not harvesting logs at all from the given log file path.

After lot of research, I came to know that data.json in registry folder is empty which is why filebeat is unable to read logs from log file.

Can someone please suggest how to fix this?

Note :- there is no error in filebeat logs saying permission denied to write into data.json

filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/mahesh/Documents/refactor/nomi/unity/media/*.log

output.logstash:
  enabled: true
  hosts: ["localhost:5044"]
2

Hi!

data.json file is used by Filebeat to store states of harvested files. If Filebeat is not harvesting from files then this data.json file will be empty. So what you watch is symptom and not the reason.

Could you please start filebeat in debug mode (./filebeat -e -d "*") and share the logs with us?

C.

3

@ChrsMark yes, you are correct... I have changed the filebeat yml to following config and it worked. althought still i coudnlt see the logs in filebeat but its being sent to logstash directly in real time :slight_smile:

filebeat.inputs:
- type: log
  paths:
    - /your/path/goes/here/*.log
output.logstash:
  enabled: true
  hosts: ["localhost:5044"]
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.