How to know my filebeat is collecting the running container logs or not

Elastic Stack Beats
1

Hi guys,

can u tell me my filebeat is collecting the running container logs? here is my filebeat output

Attaching to customfilebeat_filebeat_1
filebeat_1 | Initializing Filebeat...
filebeat_1 | 2018/04/27 13:56:59.261107 beat.go:297: INFO Home path: [/opt/filebeat-5.6.2-linux-x86_64] Config path: [/opt/filebeat-5.6.2-linux-x86_64] Data path: [/opt/filebeat-5.6.2-linux-x86_64/data] Logs path: [/opt/filebeat-5.6.2-linux-x86_64/logs]
filebeat_1 | 2018/04/27 13:56:59.261169 beat.go:192: INFO Setup Beat: filebeat; Version: 5.6.2
filebeat_1 | 2018/04/27 13:56:59.261290 logstash.go:90: INFO Max Retries set to: 3
filebeat_1 | 2018/04/27 13:56:59.261393 outputs.go:108: INFO Activated logstash as output plugin.
filebeat_1 | 2018/04/27 13:56:59.261613 publish.go:300: INFO Publisher name: 2304b1542a03
filebeat_1 | 2018/04/27 13:56:59.262110 async.go:63: INFO Flush Interval set to: 1s
filebeat_1 | 2018/04/27 13:56:59.262141 async.go:64: INFO Max Bulk Size set to: 8192
filebeat_1 | 2018/04/27 13:56:59.262565 beat.go:233: INFO filebeat start running.
filebeat_1 | 2018/04/27 13:56:59.262618 registrar.go:68: INFO No registry file found under: /opt/filebeat-5.6.2-linux-x86_64/data/.filebeat. Creating a new registry file.
filebeat_1 | 2018/04/27 13:56:59.263017 metrics.go:23: INFO Metrics logging every 30s
filebeat_1 | 2018/04/27 13:56:59.263953 registrar.go:106: INFO Loading registrar data from /opt/filebeat-5.6.2-linux-x86_64/data/.filebeat
filebeat_1 | 2018/04/27 13:56:59.264008 registrar.go:123: INFO States Loaded from registrar: 0
filebeat_1 | 2018/04/27 13:56:59.264075 crawler.go:38: INFO Loading Prospectors: 1
filebeat_1 | 2018/04/27 13:56:59.264200 prospector_log.go:65: INFO Prospector with previous states loaded: 0
filebeat_1 | 2018/04/27 13:56:59.264244 registrar.go:236: INFO Starting Registrar
filebeat_1 | 2018/04/27 13:56:59.264287 sync.go:41: INFO Start sending events to output
filebeat_1 | 2018/04/27 13:56:59.264477 prospector.go:124: INFO Starting prospector of type: log; id: 16267381897624555109
filebeat_1 | 2018/04/27 13:56:59.264503 crawler.go:58: INFO Loading and starting Prospectors completed. Enabled prospectors: 1
filebeat_1 | 2018/04/27 13:56:59.264540 spooler.go:63: INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
filebeat_1 | 2018/04/27 13:57:29.263369 metrics.go:39: INFO Non-zero metrics in the last 30s: registrar.writes=1
filebeat_1 | 2018/04/27 13:57:59.263416 metrics.go:34: INFO No non-zero metrics in the last 30s
filebeat_1 | 2018/04/27 13:58:29.263372 metrics.go:34: INFO No non-zero metrics in the last 30s
filebeat_1 | 2018/04/27 13:58:59.263341 metrics.go:34: INFO No non-zero metrics in the last 30s

Thanks in Advance.

2

It should be visible in the metrics provided by Filebeat. However, you have No non-zero metrics in the last 30s in the log, so it's possible that nothing is being sent.
Could you share the debug logs (./filebeat -e -d "*") formatted using </>?

3

Hi @Noémi Ványi, sorry for the late reply. I am getting below log while running ./filebeat -e -d "*"

filebeat2018/04/28 11:49:44.114695 beat.go:346: CRIT Exiting: error loading config file: stat filebeat.yml: no such file or directory
Exiting: error loading config file: stat filebeat.yml: no such file or directory

filebeat.yml :--

filebeat:
tail_files: true
prospectors:
paths:
- /var/log/*.log
input_type: log
document_type: log
multiline.pattern: '^[[:space:]]'
multiline.negate: false
multiline.match: after
registry_file: .filebeat
output:
logstash:
hosts: ["{{LOGSTASH_HOST}}:{{LOGSTASH_PORT}}"]
worker: 1
index: filebeat
bulk_max_size : 8192
shipper:
name:

help me!

4

You need to specify the path to the config file using -c. Also, please format your config using </>, so indentation problems become visible.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.