Dear All,
I have already installed on my local computer ELK Docker Container and Filebeat.
I could read my local glassfish log directly from Kibana dashboard. But I want that the log file should be forwarding to ELK Container "Logstash" first.
under my ELK Container I found this conf.d folder with the following files
root@4569cf1f66ab:/etc/logstash/conf.d# ls
01-lumberjack-input.conf 02-beats-input.conf 10-syslog.conf 11-nginx.conf 30-output.conf
My current configuration look like here.
filebeat.yml file
################### Filebeat Configuration Example #########################
############################# Filebeat ######################################
filebeat:
# List of prospectors to fetch data.
prospectors:
- /Users/mmlug/Documents/university/project/runtime/glassfish-3.1/glassfish/domains/domain1/logs/server.log
#- c:\programdata\elasticsearch\logs\*
input_type: log
exclude_lines: ["^DBG"]
output:
### Elasticsearch as output
elasticsearch:
hosts: ["localhost:9200"]
### Logstash as output
#logstash:
# The Logstash hosts
#hosts: ["localhost:5044"]
Step 1 Starting Docker : sudo docker-compose up elk
Step 2 : sudo ./filebeat -e -c filebeat.yml -d "publish"
When I enable "Logstash" as a output, I always got an errors as below...
Loading config file error: YAML config parsing failed on filebeat.yml: yaml: line 279: found character that cannot start any token. Exiting.
Many thanks in advance.
Best Regards,
Thomas.