Filestream input ID without ID might lead to data duplication

Elastic Stack Beats
2

Hi @jean.bissonnette,

You're describing two very different things, so let's go one by one.

1. filestream input ID without ID might lead to data duplication, please add an ID and restart Filebeat

It seems you're running Filebeat stand alone using the filestream input, right?

The error message you're seeing is because on your configuration file there are more than one filestream input without an ID set. To fix that just set a unique ID for each filestream input on your configuration file. Something like this:

filebeat.inputs:

- type: filestream
  enabled: true
  id: "foo-bar"
  paths:
    - /foo/bar*.log

- type: filestream
  enabled: true
  id: "something-else"
  paths:
    - /somehting/else/*.log

The field file.name refers to Filebeat's source code, the file and line of code that issued that log message, hence you won't find it in your environment :wink:

2. Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed.

This is a warning that is printed every time Filebeat starts, it is printed regardless of the certificates being used. It is there to warn about this change in certificates validation that will be introduced at some point, thus rendering some old certificates invalid.

If you followed our documentation and used the tools shipped with Elasticsearch to generate the certificates you don't have to worry about anything.

1 Like