Fliebeats + apache files

vsekvsek · September 22, 2020, 8:35pm

I am trying to load some local log files into filebeat and get this error.

.\filebeat.exe setup -e

2020-09-22T13:28:52.813-0700 ERROR [esclientleg] eslegclient/connection.go:261 error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '<' looking for beginning of value
2020-09-22T13:28:52.814-0700 ERROR instance/beat.go:951 Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at http://localhost:5601: Failed to parse JSON response: invalid character '<' looking for beginning of value]

My yml file is here. Is there something wrong with my yml files?

warkolm · September 22, 2020, 10:31pm

Lines 157-162 in your config are in the wrong location, you should move those to the correct sections they belong in.

vsekvsek · September 23, 2020, 8:18pm

Hello, I can start up everything fine and dont get errors now. But when I click "discover" there are no apache logs. Even though they are in the location specified in yml file, ideas on what to check?

yml file here

PS C:\Program Files\Filebeat> .\filebeat.exe -e
2020-09-23T13:06:18.769-0700    INFO    instance/beat.go:640    Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs]
2020-09-23T13:06:18.769-0700    INFO    instance/beat.go:648    Beat ID: 183cf0bf-b9ef-4645-95ee-041ae6723718
2020-09-23T13:06:18.807-0700    INFO    [beat]  instance/beat.go:976    Beat info       {"system_info": {"beat": {"path": {"config": "C:\\Program Files\\Filebeat", "data": "C:\\Program Files\\Filebeat\\data", "home": "C:\\Program Files\\Filebeat", "logs": "C:\\Program Files\\Filebeat\\logs"}, "type": "filebeat", "uuid": "183cf0bf-b9ef-4645-95ee-041ae6723718"}}}
2020-09-23T13:06:18.807-0700    INFO    [beat]  instance/beat.go:985    Build info      {"system_info": {"build": {"commit": "ad823eca4cc74439d1a44351c596c12ab51054f5", "libbeat": "7.9.1", "time": "2020-09-01T19:58:48.000Z", "version": "7.9.1"}}}
2020-09-23T13:06:18.808-0700    INFO    [add_cloud_metadata]    add_cloud_metadata/add_cloud_metadata.go:89     add_cloud_metadata: hosting provider type not detected.
2020-09-23T13:06:18.808-0700    INFO    [beat]  instance/beat.go:988    Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":12,"version":"go1.14.7"}}}
2020-09-23T13:06:18.829-0700    INFO    [beat]  instance/beat.go:992    Host info       {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-09-23T12:37:20.35-07:00","name":"CHQ-STEVEK-LX","ip":["172.19.95.8/32","fe80::d1ea:e9e5:ab57:3ab/64","169.254.3.171/16","fe80::88b5:7e23:667a:f144/64","169.254.241.68/16","fe80::bdde:2e99:c4d3:bfa6/64","169.254.191.166/16","2601:600:9700:2480::8392/128","2601:600:9700:2480:1c6d:c403:fa38:c54d/64","2601:600:9700:2480:bd13:c250:dd6a:413d/128","fe80::1c6d:c403:fa38:c54d/64","10.0.0.224/24","fe80::a0fe:72d5:b6d6:a964/64","169.254.169.100/16","::1/128","127.0.0.1/8"],"kernel_version":"10.0.17763.1457 (WinBuild.160101.0800)","mac":["98:e7:43:6c:64:c6","50:eb:71:9c:5d:f2","52:eb:71:9c:5d:f1","50:eb:71:9c:5d:f1","50:eb:71:9c:5d:f5"],"os":{"family":"windows","platform":"windows","name":"Windows 10 Enterprise","version":"10.0","major":10,"minor":0,"patch":0,"build":"17763.1457"},"timezone":"PDT","timezone_offset_sec":-25200,"id":"93607a26-e77c-4f53-9784-39ba1e2185e2"}}}
2020-09-23T13:06:18.830-0700    INFO    [beat]  instance/beat.go:1021   Process info    {"system_info": {"process": {"cwd": "C:\\Program Files\\Filebeat", "exe": "C:\\Program Files\\Filebeat\\filebeat.exe", "name": "filebeat.exe", "pid": 8200, "ppid": 5236, "start_time": "2020-09-23T13:06:18.187-0700"}}}
2020-09-23T13:06:18.831-0700    INFO    instance/beat.go:299    Setup Beat: filebeat; Version: 7.9.1
2020-09-23T13:06:18.831-0700    INFO    [index-management]      idxmgmt/std.go:184      Set output.elasticsearch.index to 'filebeat-7.9.1' as ILM is enabled.
2020-09-23T13:06:18.831-0700    INFO    eslegclient/connection.go:99    elasticsearch url: http://localhost:9200
2020-09-23T13:06:18.832-0700    INFO    [publisher]     pipeline/module.go:113  Beat name: CHQ-STEVEK-LX
2020-09-23T13:06:18.843-0700    INFO    instance/beat.go:450    filebeat start running.
2020-09-23T13:06:18.843-0700    INFO    [monitoring]    log/log.go:118  Starting metrics logging every 30s
2020-09-23T13:06:18.847-0700    INFO    memlog/store.go:119     Loading data file of 'C:\Program Files\Filebeat\data\registry\filebeat' succeeded. Active transaction id=0
2020-09-23T13:06:18.847-0700    INFO    memlog/store.go:124     Finished loading transaction log file for 'C:\Program Files\Filebeat\data\registry\filebeat'. Active transaction id=0
2020-09-23T13:06:18.848-0700    INFO    [registrar]     registrar/registrar.go:109      States Loaded from registrar: 0
2020-09-23T13:06:18.848-0700    INFO    [crawler]       beater/crawler.go:71    Loading Inputs: 0
2020-09-23T13:06:18.851-0700    INFO    [crawler]       beater/crawler.go:108   Loading and starting Inputs completed. Enabled inputs: 0
2020-09-23T13:06:18.851-0700    INFO    cfgfile/reload.go:164   Config reloader started
2020-09-23T13:06:18.851-0700    INFO    cfgfile/reload.go:224   Loading of config files completed.
2020-09-23T13:06:48.846-0700    INFO    [monitoring]    log/log.go:145  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31,"time":{"ms":31}},"total":{"ticks":93,"time":{"ms":93},"value":93},"user":{"ticks":62,"time":{"ms":62}}},"handles":{"open":273},"info":{"ephemeral_id":"9f07d0d1-a6bd-42d1-aa10-82481798038f","uptime":{"ms":30614}},"memstats":{"gc_next":15015504,"memory_alloc":8803632,"memory_total":35789016,"rss":49242112},"runtime":{"goroutines":19}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0},"reloads":1,"scans":1},"output":{"type":"elasticsearch"},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}},"system":{"cpu":{"cores":12}}}}}
2020-09-23T13:07:18.844-0700    INFO    [monitoring]    log/log.go:145  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":31},"total":{"ticks":93,"value":93},"user":{"ticks":62}},"handles":{"open":267},"info":{"ephemeral_id":"9f07d0d1-a6bd-42d1-aa10-82481798038f","uptime":{"ms":60614}},"memstats":{"gc_next":15015504,"memory_alloc":8858592,"memory_total":35843976,"rss":16384},"runtime":{"goroutines":19}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":0,"events":{"active":0}}},"registrar":{"states":{"current":0}}}}}

system · October 21, 2020, 8:18pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.