FileBeat Startup error - No paths were defined for input accessing

Elastic Stack Beats
1

I am using filebeat 7.8.1

Following is the filebeat configuration file

        - type: kubernetes          
          in_cluster: true
          tags:
            - "kubernetes"
          templates:
            - condition:
                 or:
                    - equals:
                         kubernetes.container.name: "abc"
              config :
                - type: log
                  paths:
					   - "/var/lib/kubelet/pods/${data.kubernetes.pod.uid}/volumes/**/*.log.0"
                       - "/var/lib/kubelet/pods/${data.kubernetes.pod.uid}/volumes/**/*_log"
                  fields:
                       logplane: abclog
            - condition:
                 or:
                    - equals:
                         kubernetes.container.name: "def"                    
              config :
                - type: log
                  paths:
                      - "/var/lib/kubelet/pods/${data.kubernetes.pod.uid}/volumes/**/*.log.0"
                      - "/var/lib/kubelet/pods/${data.kubernetes.pod.uid}/volumes/**/*_log"
                  fields:
                       logplane: deflog
            - condition:
                and:
                - not.equals:
                    kubernetes.container.name: abc
                - not.equals:
                    kubernetes.container.name: def                
              config :
                - type: log
                  paths:
                     - "/var/lib/docker/containers/${data.kubernetes.container.id}/*.log"
                  fields:
                    logplane: otherslog
          appenders:
            - type: config
              config:
                fields_under_root: true
                close_timeout: 0
                tail_files: true
                processors:
                - rename:
                    fields:
                    - from: "log"
                      to: "logs"
                    ignore_missing: true
                    fail_on_error: false
                - decode_json_fields:
                    fields: ["logmsg"]
                    target: "json"
                    max_depth: 1```

After deployment of filebeat, i am gettting following error message:

```2021-05-26T04:03:14.105Z        ERROR   [autodiscover]  autodiscover/autodiscover.go:209        Auto discover config check failed for config '{
"close_timeout": 0,
"fields": {
"logplane": "otherslog"
},
"fields_under_root": true,
"processors": [
{
"rename": {
"fail_on_error": false,
"fields": [
{
"from": "log",
"to": "logs"
}
],
"ignore_missing": true
}
},
{
"decode_json_fields": {
"fields": [
"logmsg"
],
"max_depth": 1,
"target": "json"
}
}
],
"tail_files": true,
"type": "log"
}', won't start runner: No paths were defined for input accessing 'data.config.0'```

I already defined the path but still, it says no Paths were defined. Can anyone share feedback and confirm what is mis-configured?
2

Did you try to reduce the YML file to single config entries and try to bisect which one is wrong? Are all paths present on the host?

3

Yes, I tried that as well but sometimes an error is coming without a log plane and with the "otherslog" log plane. When debug logs were enabled, all successful harvest had a "path" and for error cases, file path was missing. I couldn't understand without matching file path how could appender is called.

4

Could you please these debug logs? It's hard to figure out your problem without more details.

5

Yes, it's really cumbersome but I extracted the logs into another file and then searched for the error msg and compare the difference. Do you need some inputs for analysis?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.