# Logging messages sent to rabbitmq with packetbeat

**URL:** <https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [January 2, 2019, 12:00pm UTC](https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646 "2019-01-02T12:00:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![alek](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@alek](https://discuss.elastic.co/u/alek)\
**Post date:** [January 2, 2019, 12:00pm UTC](https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646/1 "2019-01-02T12:00:30Z")

</div>

We try to setup packetbeat to 6.5.4 to parse AMQP protocol.  
However we don't see messages body sent to Elastic and indexed.  
Do we miss something ?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 2, 2019, 4:12pm UTC](https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646/2 "2019-01-02T16:12:18Z")

</div>

Hi,

Can you give us:

- The rabbitmq version
- Your configuration (packetbeat.yml)
- The output of running packetbeat with debug enabled ( `-d '*'`).

---

<div class="post-metadata">

**Author:** ![alek](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@alek](https://discuss.elastic.co/u/alek)\
**Post date:** [January 3, 2019, 7:32am UTC](https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646/3 "2019-01-03T07:32:42Z")

</div>

## Hi, Thanks for your prompt response. I am using RabbitMQ 3.7.9 version packetbeat.yml :

packetbeat.interfaces.device: any  
packetbeat.interfaces.type: af\_packet  
packetbeat.flows:  
timeout: 30s  
period: 10s  
packetbeat.protocols:

- type: icmp  
enabled: false
- type: amqp  
ports: [5672]  
send\_request: true  
send\_response: true  
max\_body\_length: 1000  
parse\_headers: true  
parse\_arguments: true
- type: cassandra  
ports: [9042]
- type: dhcpv4  
ports: [67, 68]
- type: dns  
include\_authorities: true  
include\_additionals: true
- type: http
- type: memcache  
ports: [11211]
- type: mysql  
ports: [3306]
- type: pgsql  
ports: [5432]
- type: redis  
ports: [6379]
- type: thrift  
ports: [9090]
- type: mongodb  
ports: [27017]
- type: nfs  
ports: [2049]
- type: tls  
ports: [443]  
setup.template.settings:  
index.number\_of\_shards: 3  
setup.kibana:  
output.elasticsearch:  
hosts: ["1.1.0.1:8080"]  
username: "xxxx"  
password: "xx"  
processors:
  - add\_host\_metadata: ~
  - add\_cloud\_metadata: ~  
logging.level: debug  
logging.selectors: ["\*"]  
xpack.monitoring.enabled: true  
xpack.monitoring.elasticsearch:

* * *

I was unable to upload or attach debug output.  
Where can I send it ?

Thanks,  
Alex.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [January 3, 2019, 11:01am UTC](https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646/4 "2019-01-03T11:01:34Z")

</div>

can you upload the logs to some service like [pastebin.com](http://pastebin.com) or google drive and share a link with me? You can use a private message if you don't want the log to be public.

> [@alek](#):
>
> type: amqp  
> ports: [5672]

Have you checked that your rabbitmq traffic is using this port? Can you also provide a capture (pcap) of the network traffic?

---

<div class="post-metadata">

**Author:** ![alek](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@alek](https://discuss.elastic.co/u/alek)\
**Post date:** [January 3, 2019, 12:01pm UTC](https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646/5 "2019-01-03T12:01:37Z")

</div>

Thanks for your response again !  
We use default port 5672 and I have sent you logs privately

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2019, 12:01pm UTC](https://discuss.elastic.co/t/logging-messages-sent-to-rabbitmq-with-packetbeat/162646/6 "2019-01-31T12:01:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.