Filebeat.yml logging issue


I noticed that my filebeat beat was not producing a log file. I realized that I never set a filename, path, etc... I set the following, but I get the following error with the file path:

Any suggestion would be greatly appreciated.



This is my code of filebeat.yml and is working perfectly. Hope this works, If doesnot then look for the other integrations you are doing with filebeat.


  • type: docker
    combine_partial: true
    path: "/usr/share/dockerlogs/data"
    stream: "stdout"
    - "*"
    exclude_files: ['.gz$']
    ignore_older: 10m


decode the log field (sub JSON document) if JSON encoded, then maps it's fields to elasticsearch fields

  • decode_json_fields:
    fields: ["log", "message"]
    target: ""

    overwrite existing target elasticsearch fields while decoding json fields

    overwrite_keys: true
  • add_docker_metadata:
    host: "unix:///var/run/docker.sock"

path: ${path.config}/modules.d/*.yml
reload.enabled: false

setup filebeat to send output to logstash

hosts: ["logstash"]

Write Filebeat own logs only to file to avoid catching them with itself in docker log files

logging.level: error
logging.to_files: false
logging.to_syslog: false
loggins.metrice.enabled: false
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644
ssl.verification_mode: none

Thank you for your reply. I think that the issue is the path to the log file and the fact that it contains spaces. Regardless of the types of quotes I use, I still get this error.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.