Filebeat is failing with above mentioned error when trying to read a standard tomcat error log (stderr.log). I tried to debug the issue by testing with subset, and found that the header might be creating the failure, but after removing the header from the actual file, the issue repeats.
Below are the various cases tested.
stderr1.log: Log subset with 2 events & header - Fail
stderr5.log: Only single event with no header or carriage return at the end of event - Success
stderr6.log: 2 events (no header) with preceding and succeeding line feeds - Success
stderr.log: Header removed from original file - Fail
The log file is being captured when I feed it to Logstash directly. Not able to attach any of the log or configuration files due to type limitations. Please look into this and suggest.
Version 5.1.1 is being used for the complete setup being run on Windows server.
Filebeat --> LogStash --> ElasticSearch --> Kibana
Hi Andrew, thanks for reply. Please find the link to gist where required artifacts have been pasted.
The Windows server where ELK stack is installed and am also testing filebeat on has Windows Server 2012 R2 Standard operating system. Actual application server where the filebeat is harvesting logs from is also a Windows server.