Hi Team,
I am trying to setup beats central management, at the beginning of enrollment I have configured /tmp/test1.txt file for monitoring, then started beats agent, I am able to see the events in logstash.
After that, I have added one more file /tmp/test2.yml input under the configuration section, but this time I am not able to see the logs of /tmp/test2.yml until I restarted the beats agent again.
Is it expected behavior of central management of beats?
Thanks
do you modify configuration file directly?
No, I am not.
I am trying to update beats configuration directly from central management only.
Thanks
in central management you need to configure filebeat.inputs
also central management should log that it received configuration or something similar. can you please check/share so we can see if there's something weird happening?
in logs you should see something like this
2019-07-31T09:01:00.910Z INFO [centralmgmt] manager.go:211 Applying settings for filebeat.inputs
In central management, first I have configured filebeat.input to fetch the logs which match the following pattern /root/filebt/*.txt
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:239#011New configurations retrieved
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'IN_PROGRESS'
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.inputs
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011log/harvester.go:274#011Reader was closed: /root/fb/test.txt. Closing.
**2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011log/input.go:148#011Configured paths: [/root/filebt/*.txt]**
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.410+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for output
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.modules
** 2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'RUNNING'**
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011[centralmgmt]#011management/manager.go:191#011Storing new state
2019-08-09 17:59:13 elasticsearch_masternode filebeat: info 2019-08-09T17:59:13.411+0530#011INFO#011log/harvester.go:253#011Harvester started for file: /root/filebt/test.txt
2019-08-09 17:59:14 elasticsearch_masternode filebeat: info 2019-08-09T17:59:14.411+0530#011INFO#011pipeline/output.go:95#011Connecting to backoff(async(tcp://192.168.1.59:5050))
2019-08-09 17:59:14 elasticsearch_masternode filebeat: info 2019-08-09T17:59:14.412+0530#011INFO#011pipeline/output.go:105#011Connection to backoff(async(tcp://192.168.1.59:5050)) established
2019-08-09 17:59:21 elasticsearch_masternode crmd[1870]: notice notice: State transition S_IDLE -> S_POLICY_ENGINE
2019-08-09 17:59:21 elasticsearch_masternode crmd[1870]: notice notice: Transition 3226 (Complete=0, Pending=0, Fired=0, Skipped=0, Incomplete=0, Source=/var/lib/pacemaker/pengine/pe-input-46.bz2): Complete
After that, I have added one more filebeat.input which actually fetches .csv (/root/filebt/*.csv)files from the same directory /root/filebt and then I saved this configuration and Observed the logs of filebeat.
This time filebeats failed to fetch .csv logs from /root/filebt directory.
Here are the logs of filebeat.
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.588+0530#011INFO#011[centralmgmt]#011management/manager.go:239#011New configurations retrieved
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.588+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'IN_PROGRESS'
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.588+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.inputs
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011input/input.go:149#011input ticker stopped
**2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011log/harvester.go:274#011Reader was closed: /root/filebt/test.txt. Closing.**
**2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011ERROR#011[centralmgmt]#011cfgfile/list.go:96#011Error creating runner from config: Can only start an input when all related states are finished: {Id:403511674-64768 Finished:false Fileinfo:0xc000179ee0 Source:/root/filebt/test.txt Offset:57 Timestamp:2019-08-09 17:59:14.443961705 +0530 IST m=+96229.703596804 TTL:-1ns Type:log Meta:map[] FileStateOS:403511674-64768}**
**2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011ERROR#011[centralmgmt]#011management/manager.go:315#0111 error: Error creating runner from config: Can only start an input when all related states are finished: {Id:403511674-64768 Finished:false Fileinfo:0xc000179ee0 Source:/root/filebt/test.txt Offset:57 Timestamp:2019-08-09 17:59:14.443961705 +0530 IST m=+96229.703596804 TTL:-1ns Type:log Meta:map[] FileStateOS:403511674-64768}**
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.modules
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.589+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'FAILED'
2019-08-09 18:01:14 elasticsearch_masternode filebeat: info 2019-08-09T18:01:14.590+0530#011INFO#011[centralmgmt]#011management/manager.go:191#011Storing new state
2019-08-09 18:01:24 elasticsearch_masternode filebeat: info
I am hoping that I am getting this error because I am pointing the same directory twice in filebeat.input section.
And If I specify a different directory like /root/filebt1/*.log instead of /root/filebt/*.csv
Beats agent perfectly able to receive the configuration from Kibana and sending the logs to output section.
Here are the logs of beats agent for /root/filebt1/*.log
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:239#011New configurations retrieved
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'IN_PROGRESS'
**2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011log/input.go:148#011Configured paths: [/root/filebt/*.txt /root/filebt1/*.txt /]**
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:279#011Applying settings for filebeat.modules
**2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.084+0530#011INFO#011[centralmgmt]#011management/manager.go:328#011Updating state to 'RUNNING'**
2019-08-09 18:26:29 elasticsearch_masternode filebeat: info 2019-08-09T18:26:29.085+0530#011INFO#011log/harvester.go:253#011Harvester started for file: /root/filebt1/test.txt
Am I understand it correctly?
Thank you
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.