Filebeat struggles

Elastic Stack Beats
1

I must say, that I am confident it is something simple, but am struggling to make the iis module work in filebeat. :confused:
After you enable the iis module and set a custom path, it is throwing an error that

Blockquote
filebeat\modules.d\iis.yml', error invalid config: yaml: line 11: found unknown escape character
/> Blockquote

Additionally, I cannot understand as a concept how the paths work. We have a path we can declare in filebeat.yml directly. If we use only the iis module - do we need to declare the same paths there? If we use a module and a custom log file we want to send to a different ingest pipeline (to parse a special multiline log) - is this possible? Only in filebeat there is a space.id and index template we can declare, but I did not find anything in documentation about it working with the iis module. Ingest pipelines is also something not clear - can they be explicitly declared somehow? Because the log type itself has a different schema, so I don't get how will it be processed by the same pipeline...

2

Hi @vladtepes, Could you share your iis module configuration? To answer the first question you should not set the path in both the filebeat.yml and the iis.module. The best approach is to isolate all configuration in the specific modules and enable the modules.

3

Hi @fgjensen,

thank you for replying! Yes, that is how I thought too that the path should be declared only once, but then this syntax error made me think I am doing smth wrong. This is what I have in the IIS module YML:

Blockquote

  • module: iis
    access:
    enabled: true
    var.paths: 'X:\IISLogs\\.log'
    error:
    enabled: true
    var.paths: 'Y:\httpERRORLOG\*.log'

image

4

I think the correct syntax on Windows is var.paths: ["X:/IISLogs/*/*.log"]. If you have not changed the default logging directories the module actually sets the default directories, so you do not have to configure the paths. You can test the configuration with filebeat test config. This is a great way to solve configuration problems fast.

`

5

It is strange, but this is not checked by this command, since it comes out as "Config OK" for me. This is the most frustrating about it. The syntax you refer to I have already tried, as I saw it in the documentation, but it still fails after some time and in the filebeat log I can see the syntax error in the iis.yml. :confused:

6

Strange - could you set the log level to debug in filebeat.yml and post the results, when the module has failed?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.