I'm following this tutorial, where you ingest some Apache logs with FIlebeats into Elasticsearch to visualize them in Kibana.
This step-by-step set of instructions will walk you through setting up an Elastic Cloud account, creating and securing a Elasticsearch cluster, importing data, and visualizing it in Kibana.
I follow all the steps and none fails, but when I have a look at the index pattern there is no data, even changing dates.
Could someone help me? I'm doing this from Ubuntu 18.04.
Thanks in advance.
Are you able to
filebeat without errors to collect apache logs?
Yes, I think so.
I've tried with both what is said on that tutorial (with the -E and -M options) and with what appears if I go to the Kibana home page > Add log data > Apache logs > DEB (for Ubuntu) (sudo filebeat setup and sudo service filebeat start)
But with any of those it doesn't seem to work, in Kibana there is no data.
Could you check the logs and see if there is anything problematic? (you can fined them with
tail -f /var/log/filebeat/filebeat)
I've pasted the complete logs, not only the last ones, here:
I don't understand it very well, but to me it seems everything is ok.
It doesn't seem to keep running...Could you try starting Filebeat like
filebeat -e -d "*"?
That gave me an error, you meant:
filebeat -e -d "*"
right? That worked and the output is:
I have the logs file on Downloads but maybe I have to change the extension? I downloaded it and didn't touch it.
Sorry for my typo!
It seems that the
paths config is not an array.
Could you try with something like:
./filebeat -e \
-E cloud.id="Demo_Deployment:dXMtY2Vu..........jczODYke30=" \
-E cloud.auth="sa_admin:s00p3rS3cr3t" \
As I'm using Ubuntu I typed (I hope I didn't make a mistake "translating" it):
sudo filebeat -e --modules apache2 setup
But it happens the same as previously, the logs are the same as the last pastebin.
This one works for me locally:
./filebeat -e -d "*" --modules apache -M "apache.access.var.paths=[/tmp/apache_logs]"
Note that this only collects logs with
apache module, you still need to setup things with setup command etc. Also in order to make it work with cloud you need the cloud flags too.
You saying that the paths config is not an array made me search on Google the last line of the filebeat logs and found
https://discuss.elastic.co/t/unable-to-ingest-apache2-logs-through-filebeat/146309/3. I had to change the apache.yml file from:
And now it works with
filebeat -e -d "*"!!
Thanks a lot, Chris.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.