Filebeat traefik access log into elk

Elastic Stack Beats
,
1

Hello,
I'm just starting to use filebeat 7.12 and I'm having problems sending traefik access log to elk.
I was able to send the json log to elk with this snippet in the main config filebeat.yml :

filebeat.inputs:
- type: log
  enabled: true
  paths:
  - /tank/volumes/traefik/logs/access.log 
  json.keys_under_root: true
  json.add_error_key: true

But I need to setup this only in the traefik module.
I tried to config this in modules.d/traefik.yml :

- module: traefik
  access:
    input:
    - type: log
      enabled: true
      paths:
      - /tank/volumes/traefik/logs/access.log
      json.keys_under_root: true
      json.add_error_key: true

But filebeat does nothing and doesn't show errors in the log :

2021-05-12T17:06:18.507+0200	INFO	cfgfile/reload.go:164	Config reloader started
2021-05-12T17:06:28.510+0200	INFO	log/input.go:157	Configured paths: [/var/log/traefik/access.log*]
2021-05-12T17:06:28.510+0200	INFO	eslegclient/connection.go:99	elasticsearch url: https://xxx.yyy.zzz
2021-05-12T17:06:28.527+0200	INFO	[esclientleg]	eslegclient/connection.go:314	Attempting to connect to Elasticsearch version 7.12.0

Also filebeat test config answers OK.

Is it possible do this ?
Any suggestions ?

Thanks for your help
Enrico

2

To use the modules you shouldn't configure filebeat.inputs. Also I wouldn't modify the module configs except for the path. Can you show your filebeat.yml and the full log output?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.