How do i make sure that logstash received data from filebeat?

Roshan_r · May 18, 2016, 11:23am

See the output after i commented out the console section:

Starting filebeat: 2016/05/18 11:22:34.799080 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths
2016/05/18 11:22:34.799324 logstash.go:106: INFO Max Retries set to: 3
2016/05/18 11:22:34.799812 outputs.go:126: INFO Activated logstash as output plugin.
2016/05/18 11:22:34.800553 publish.go:288: INFO Publisher name: astroHeka
2016/05/18 11:22:34.800871 async.go:78: INFO Flush Interval set to: 1s
2016/05/18 11:22:34.800893 async.go:84: INFO Max Bulk Size set to: 2048
2016/05/18 11:22:34.800995 beat.go:147: INFO Init Beat: filebeat; Version: 1.2.2
[ OK ]

steffens · May 18, 2016, 11:36am

this is just the startup log. /dev/stdout being closed will become only visible if filebeat tries to publish events.

Roshan_r · May 18, 2016, 11:37am

How can i verify from logs that data has been pushed by filebeat?

Roshan_r · May 23, 2016, 2:50pm

Any updates steffens?

ruflin · May 23, 2016, 4:05pm

You should see in the log file something like X events sent. Best is to change the log level to debug, then you see all changes.

steffens · May 23, 2016, 4:11pm

@Roshan_r the logs posted have been very incomplete. Disabling the console output in config file should help with error being reported. As @ruflin suggested, you can turn on info/debug log in order to see successfull/failed send attempts in filebeat logs.