Logstash cannot get filebeat's data

This is my /etc/filebeat/filebeat.yml

- type: log

      enabled: true

        - /var2/log/cloud/test.log

      # Glob pattern for configuration loading
      path: ${path.config}/modules.d/*.yml

      # Set to true to enable config reloading
      reload.enabled: false

      # Period on which files under path should be checked for changes
      #reload.period: 10s

      index.number_of_shards: 3
      #index.codec: best_compression
      #_source.enabled: false

    setup.dashboards.enabled: false


      host: ""

      # Optional protocol and basic auth credentials.
      protocol: "http"
      username: "admin"
      password: "admin"

      # The Logstash hosts
      hosts: [""]

      ssl.enabled: false
      #### we use our generated certificates from ELK
      ssl.certificate_authorities: ["/etc/beat/beat-forwarder.crt"]

      # Certificate for SSL client authentication
      ssl.certificate: "/etc/beat/beat-forwarder.crt"

      # Client Certificate Key
      ssl.key: "/etc/beat/beat-forwarder.key"

      - add_host_metadata: ~
      - add_cloud_metadata: ~

    logging.level: info
    logging.to_files: true
      path: /var/log/filebeat
      name: filebeat
      keepfiles: 7
      permissions: 0644

I can telnet 5044
filebeat should work fine

here is my /etc/logstash/conf.d/logstash.conf on

input {
  tcp {
    port => 5000
    type => syslog
  udp {
    port => 5000
    type => syslog

input {
  beats {
    port => "5044"
    ssl => false
    ssl_certificate => ["/usr/share/logstash/beat-forwarder.crt"]
    ssl_key => ["/usr/share/logstash/beat-forwarder.key"]
    ssl_verify_mode => none

filter {
  mutate {
    remove_field => [ "[host]" ]
  mutate {
    add_field => {
      "host" => "%{[beat][hostname]}"


output {
  stdout { }

I run the logstash by /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf, but no matter how I add lines in the log file /var2/log/cloud/test.log, nothing prints. Can anyone help to see what is wrong?

you can do filebeat test output to test the logstash output

can you explore more about what do you mean with this?

The tracked file configured in filebeat.yml: /var2/log/cloud/test.log

is your filebeat test output successful ? if logstash is not producing any output , my initial suspect will be that it does not receive any inputs

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.