Filebeat works for Centos 5.7

I'm trying for while but not sure filebeat supports centos 5.7 able to install but no luck to strat it any sugessition would be helpful.
uname -a

2.6.18-274.el5 #1 SMP Fri Jul 8 17:36:59 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

[root@ccdn-cm-40303-01 (bmcs1) rguttu001c]# rpm --delsign filebeat-5.1.1-i686.rpm
error: filebeat-5.1.1-i686.rpm: open failed: No such file or directory
[root@xxxxxxxx (bmcs1) rguttu001c]# rpm --delsign filebeat-5.2.1-x86_64.rpm
[root@xxxxxxx (bmcs1) rguttu001c]# sudo yum -y localinstall --nogpgcheck filebeat-5.2.1-x86_64.rpm
Loaded plugins: product-id, security, subscription-manager
Updating Red Hat repositories.
Setting up Local Package Process
Examining filebeat-5.2.1-x86_64.rpm: filebeat-5.2.1-1.x86_64
Marking filebeat-5.2.1-x86_64.rpm to be installed
Resolving Dependencies
--> Running transaction check
---> Package filebeat.x86_64 0:5.2.1-1 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

Package Arch Version Repository Size

filebeat x86_64 5.2.1-1 /filebeat-5.2.1-x86_64 27 M

Transaction Summary

Install 1 Package(s)
Upgrade 0 Package(s)

Total size: 27 M
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : filebeat 1/1
duration: 0(ms)
Installed products updated.

filebeat.x86_64 0:5.2.1-1

[root@ccdn-cm-40303-01 (bmcs1) rguttu001c]# service filebeat start
Starting filebeat: 2017/02/28 14:44:30.167254 beat.go:267: INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017/02/28 14:44:30.167293 beat.go:177: INFO Setup Beat: filebeat; Version: 5.2.1
2017/02/28 14:44:30.167478 output.go:167: INFO Loading template enabled. Reading template file: /etc/filebeat/filebeat.template.json
2017/02/28 14:44:30.167843 output.go:178: INFO Loading template enabled for Elasticsearch 2.x. Reading template file: /etc/filebeat/filebeat.template-es2x.json
2017/02/28 14:44:30.168148 client.go:120: INFO Elasticsearch url: http://localhost:9200
2017/02/28 14:44:30.168197 outputs.go:106: INFO Activated elasticsearch as output plugin.
2017/02/28 14:44:30.168300 publish.go:291: INFO Publisher name: xxxxx
2017/02/28 14:44:30.168469 logp.go:219: INFO Metrics logging every 30s
2017/02/28 14:44:30.168519 async.go:63: INFO Flush Interval set to: 1s
2017/02/28 14:44:30.168537 async.go:64: INFO Max Bulk Size set to: 50
Config OK
FATAL: kernel too old
/bin/bash: line 1: 2664 Segmentation fault /usr/share/filebeat/bin/filebeat-god -r / -n -p /var/run/ -- /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat /var/lib/filebeat -path.logs /var/log/filebeat

Bottom line: Filebeat is not supported on RHEL 5. See the support matrix.

The problem you have encountered is with the filebeat-god processes which was compiled for a newer version of libc IIRC. So probably if you run -e Filebeat will start up. But if you use service filebeat start it will fail. You could hack the /etc/init.d/filebeat script to not use filebeat-god or you could compile filebeat-god for your system (source is here).

Thanks for your advice it worked perfectly able to ship logs

its there a way i can run as service :slight_smile:

@andrewkroh fixed thanks for your support

l I had to do is create an alternate version of the startup script

this is a workaround solution

the new init.d script is:

# filebeat:          Startup script for Filebeat Log Shipper.
# chkconfig: 3 80 05
# description:      Startup script for Filebeat Log Shipper standalone


start() {
       echo -n "Starting Filebeat: "
       echo "Starting Filebeat at `date`" >> $FILEBEAT_HOME/startup.log
       /usr/share/filebeat/bin/filebeat \
      -path.home /usr/share/filebeat \
      -path.config /etc/filebeat \ /var/lib/filebeat \
      -path.logs /var/log/filebeat -e &
       sleep 2
       echo "done"

stop() {
       echo -n "Stopping Filebeat: "
       echo "Stopping Filebeat at `date`" >> $FILEBEAT_HOME/startup.log
       su $FILEBEAT_OWNER -c "pkill filebeat"
       echo "done"

# See how we were called.
case "$1" in
               if pgrep -fl "/usr/share/filebeat/bin/filebeat" > /dev/null;then echo running;else echo not running;fi
               echo $"Usage: filebeat {start|stop|restart}"
# Make the file executable
$ chmod +x /etc/init.d/filebeat-standalone

Worked with out issues :)
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.