Journalbeat can't open a log file

[DenProg (Denis)]

Hi.
I describe specific log file in the config as it's written in the docs:

journalbeat.inputs:
- paths: 
  - "/var/log/syslog"

This file is present, but Journalbeat can't open it for some reason:

авг 24 15:53:29 computer journalbeat[28297]: 2020-08-24T15:53:29.469+0300        INFO        instance/beat.go:419        journalbeat stopped.
авг 24 15:53:29 computer journalbeat[28297]: 2020-08-24T15:53:29.469+0300        ERROR        instance/beat.go:951        Exiting: error creating reader for journal: reader.go:120: failed to open journal file /var/log/syslog (path=/var/log/syslog)
авг 24 15:53:29 computer journalbeat[28297]:         failed to open journals in paths ["/var/log/syslog"]: bad message
авг 24 15:53:29 computer journalbeat[28297]: Exiting: error creating reader for journal: reader.go:120: failed to open journal file /var/log/syslog (path=/var/log/syslog)
авг 24 15:53:29 computer journalbeat[28297]:         failed to open journals in paths ["/var/log/syslog"]: bad message

What's wrong? How to work with specific files?

[Mario_Castro]

Hi @DenProg

I'm not expert in Journalbeat but... can you try to use a path like "/var/log/syslog/*" I think it might be an error in Journalbeat docs.

If it doesn't work, can you specify directly a file by its filename? Just to make the check.

Thanks!

[DenProg (Denis)]

Hi @Mario_Castro
/var/log/syslog is a file, not a directory. I tried other files with the same result.

[Mario_Castro]

Ok so maybe it's something regarding the "format" of the data inside the file. The error happens when trying to "create a systemd Journal from the file" as far as I can see in the code. Can you check that the format is the one expected from systemd https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html