Filebeat.yml logging issue

Elastic Stack Beats
1

Hello,

I noticed that my filebeat beat was not producing a log file. I realized that I never set a filename, path, etc... I set the following, but I get the following error with the file path:

image
image949×684 106 KB

Any suggestion would be greatly appreciated.

Sincerely,

RS

2

This is my code of filebeat.yml and is working perfectly. Hope this works, If doesnot then look for the other integrations you are doing with filebeat.

filebeat.inputs:

  • type: docker
    combine_partial: true
    containers:
    path: "/usr/share/dockerlogs/data"
    stream: "stdout"
    ids:
    - "*"
    exclude_files: ['.gz$']
    ignore_older: 10m

processors:

decode the log field (sub JSON document) if JSON encoded, then maps it's fields to elasticsearch fields

  • decode_json_fields:
    fields: ["log", "message"]
    target: ""

    overwrite existing target elasticsearch fields while decoding json fields

    overwrite_keys: true
  • add_docker_metadata:
    host: "unix:///var/run/docker.sock"

filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false

setup filebeat to send output to logstash

output.logstash:
hosts: ["logstash"]

Write Filebeat own logs only to file to avoid catching them with itself in docker log files

logging.level: error
logging.to_files: false
logging.to_syslog: false
loggins.metrice.enabled: false
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644
ssl.verification_mode: none

3

Thank you for your reply. I think that the issue is the path to the log file and the fact that it contains spaces. Regardless of the types of quotes I use, I still get this error.