Logstash index created but no data in pipeline

Logstash is creating index in elasticsearch but no data is sent. I think its because the logs file from Filebeat to Logstash isn't being sent. So my question is- how to check pipeline is created and data is being sent from filebeats to logstash port?

Index details:
yellow open logstash-2019.10.30-000001 WnnV21usSDqM18yvaVowZQ 1 1 0 0 283b 283b

No data document in index:
{
"count" : 0,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
}
}

Here is pipeline.conf file:
// Read input from filebeat by listening to port 5044 on which filebeat will send the data
input {
beats {
type => "another_test"
port => "5044"
}
}
filter {

}
output {
//stdout {
// codec => rubydebug
//}
/ /Sending properly parsed log events to elasticsearch
elasticsearch {
hosts => ["localhost:9200"]
}
}

Hi,

You can start filebeat in debug mode:
filebeat -e -d "*"
This will show you exactly what is being passed on the destination you defined in the filebeat.yml configuration file.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.