Lostash taking inputs from Filebeat

Hi Team,

Can anyone provide me the configuration file, Where the logstash will be taking input from Filebeat port and creating the same files as output in logstash .

Ex : input > filebeat text file
output > logstash text file

TIA

Filebeat will populate a field with the name of the file from which the line was read. You can reference that field in the path option of a file output. I suggest you use a stdout { codec => rubydebug } output to dump the raw events while you're experimenting with this.

this is the code i am using,

input
{
beats
{
port => 5044
ignore_older =>0
}
}
output
{
stdout{ codec=> rubydebus}
file{
path = "data\filebeat\logstash.txt"
}
}

But i am facing error as Logstash configuration error .Is this the right code or should i write some more logic to it

But i am facing error as Logstash configuration error

Always post the exact error message.

This is the error which i am facing,

And this is the code i am running in logstash

image

Please help me to resolve this issue. I want logstash to read the files which filebeat is passing and want to store in logstash with the same format as filebeat.

Please don't post screenshots. Use copy/paste of the text.

Here's the error message:

Unknown setting "ignore_older" for beats

As the message indicates the beats plugin doesn't have an option with that name. The documentation lists all valid options.

I removed ignore_older option , yet i am not able to reach a solution .

My doubt is "Is logstash can really take the .txt or .log files as input from filebeat and save it in logstash output folder as same format "

I removed ignore_older option , yet i am not able to reach a solution .

Look, this will take twice as long if I have to ask for additional details every time you ask a question.

My doubt is "Is logstash can really take the .txt or .log files as input from filebeat and save it in logstash output folder as same format "

Yes it can.

Thanks Magnus, Will try my best then :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.