I am not able to send the json file to elasticsearch through filebeat

Elastic Stack Beats
1

I am trying to send the data to elasticsearch through kibana. But I am not able to view it in kibana. I feel there is a some error in my configuration file or my json format.

My filebeat.yml file is below:

#=========================== Filebeat inputs =============================

filebeat.inputs:

- type: log
    enabled: true
  paths:
    #- /var/log/*.log
    - D:\Project\processhacker-master\logs\*.log
    - input_type: log
    - json.keys_under_root: true
    - json.add_error_key: true

Below is my json file:

{"time":"12:39:27 PM 12/17/2018","msg": "Process created: taskhostw.exe (18052) started by svchost.exe (2096)"}
{"time":"12:39:28 PM 12/17/2018","msg":" Process terminated: LogonUI.exe (4280); exit status 0x0"}
{"time":"12:39:28 PM 12/17/2018","msg":" Process terminated: AtBroker.exe (5548); exit status 0x1"}
{"time":"12:39:28 PM 12/17/2018","msg":" Process terminated: WMIC.exe (6704); exit status 0x0"}
{"time":"12:39:28 PM 12/17/2018","msg":"Process terminated: taskhostw.exe (18052); exit status 0x0"}
{"time":"12:39:28 PM 12/17/2018","msg":"Process created: backgroundTaskHost.exe (10248) started by svchost.exe (420)"}
{"time":"12:40:09 PM 12/17/2018","msg":" Process created: smartscreen.exe (16184) started by svchost.exe (420)"}

Filebeat is running, but no data is getting passed through it to elasticsearch.

2

Hello @SunilT, I took the liberty to correctly use code block in your message to make sure formatting works.

I think there is an indentation problem in your configuration in two differents places, Filebeat uses YAML as the configuration language and this syntax is really picky with indentation and Filebeat will not complain.

Can you test with the config below? Look at the indentation and how the options are defined.

filebeat.inputs:

- type: log
  enabled: true
  json.keys_under_root: true
  json.add_error_key: true
  paths:
    - D:\Project\processhacker-master\logs\*.log
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.