Filebeat is failing with above mentioned error when trying to read a standard tomcat error log (stderr.log). I tried to debug the issue by testing with subset, and found that the header might be creating the failure, but after removing the header from the actual file, the issue repeats.
Below are the various cases tested.
- stderr1.log: Log subset with 2 events & header - Fail
- stderr5.log: Only single event with no header or carriage return at the end of event - Success
- stderr6.log: 2 events (no header) with preceding and succeeding line feeds - Success
- stderr.log: Header removed from original file - Fail
The log file is being captured when I feed it to Logstash directly. Not able to attach any of the log or configuration files due to type limitations. Please look into this and suggest.
Version 5.1.1 is being used for the complete setup being run on Windows server.
Filebeat --> LogStash --> ElasticSearch --> Kibana