LogStash is able to get input from filebeat but its not able to log it in elasticsearch.
Lostash.conf :
##log stash get input from here with file beat
input {
beats {
type => "test"
port => "6000"
}
}
output to elasticsearch on port 9200
output {
stdout {
codec => rubydebug
}
Sending properly parsed log events to elasticsearch
elasticsearch {
hosts => ["localhost:9200"]
}
}
#FileBeat sending output to port 6000
output.logstash:
#loadbalance: true
hosts: ["localhost:6000"]
I'm getting this error :=> Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash", :_type=>"_doc", :routing=>nil}, #LogStash::Event:0x23895e6c], :response=>{"index"=>{"_index"=>"logstash-2019.05.09-000001", "_type"=>"_doc", "_id"=>"AtUPpmoBiN9TtUPVPKw2", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [host] of type [text] in document with id 'AtUPpmoBiN9TtUPVPKw2'", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:499"}}}}}
But I'm able to log to elasticsearch from both logstash and Filebeat seperately.