I have Debian 9 server with Nginx+PHP.
Installed Filebeat 7.4.2.
I have PHP-FPM log, which has entries like this:
slavik@deb96:/var/log/php$ sudo cat php7.0-fpm.log [11-Nov-2019 23:02:37] WARNING: [pool www] child 133043, script '/var/www/RussianChurchVancouver.ca/web/index.php' (request: "GET /index.php") executing too slow (2.092933 sec), logging [11-Nov-2019 23:16:36] WARNING: [pool www] child 133053, script '/var/www/antipa.site/web/wp-admin/admin-ajax.php' (request: "POST /wp-admin/admin-ajax.php") executing too slow (2.359414 sec), logging [11-Nov-2019 23:21:03] WARNING: [pool www] child 133051, script '/var/www/hava.propovednik.com/web/index.php' (request: "GET /index.php") executing too slow (2.079449 sec), logging [11-Nov-2019 23:39:29] WARNING: [pool www] child 133043, script '/var/www/pittsburgh-church.com/web/index.php' (request: "GET /index.php") executing too slow (2.290184 sec), logging
so, added this to my
filebeat.inputs: # Each - is an input. Most options can be set at the input level, so # you can use different inputs for various configurations. # Below are the input specific configurations. - type: log # Change to true to enable this input configuration. enabled: true # Paths that should be crawled and fetched. Glob based paths. paths: - /var/log/php/*fpm.log close_inactive: 24h # Optional additional fields. These fields can be freely picked # to add additional information to the crawled log files for filtering fields: event.dataset: "php.error" # The Ingest Node pipeline ID associated with this input. If this is set, it # overwrites the pipeline option from the Elasticsearch output. pipeline: filebeat-php-slow
I also created pipeline "filebeat-php-slow", which exists. Here is source
I restarted Filebeat.
And I don't see any events from that log.
I also have NGINX module enabled on same host. And it works fine.
What am I missing here? Is there another step I need to do?
I checked syslog, and here is what I see:
slavik@deb96:/var/log$ sudo cat syslog | grep filebeat | grep php INFO#011log/input.go:152#011Configured paths: [/var/log/php/*fpm.log] INFO#011log/harvester.go:251#011Harvester started for file: /var/log/php/php7.0-fpm.log
Can you suggest any troubleshooting steps I can do?