Lostash taking inputs from Filebeat

Elastic Stack Logstash
1

Hi Team,

Can anyone provide me the configuration file, Where the logstash will be taking input from Filebeat port and creating the same files as output in logstash .

Ex : input > filebeat text file
output > logstash text file

TIA

2

Filebeat will populate a field with the name of the file from which the line was read. You can reference that field in the path option of a file output. I suggest you use a stdout { codec => rubydebug } output to dump the raw events while you're experimenting with this.

3

this is the code i am using,

input
{
beats
{
port => 5044
ignore_older =>0
}
}
output
{
stdout{ codec=> rubydebus}
file{
path = "data\filebeat\logstash.txt"
}
}

But i am facing error as Logstash configuration error .Is this the right code or should i write some more logic to it

4

But i am facing error as Logstash configuration error

Always post the exact error message.

5

This is the error which i am facing,

And this is the code i am running in logstash

image

Please help me to resolve this issue. I want logstash to read the files which filebeat is passing and want to store in logstash with the same format as filebeat.

6

Please don't post screenshots. Use copy/paste of the text.

Here's the error message:

Unknown setting "ignore_older" for beats

As the message indicates the beats plugin doesn't have an option with that name. The documentation lists all valid options.

7

I removed ignore_older option , yet i am not able to reach a solution .

My doubt is "Is logstash can really take the .txt or .log files as input from filebeat and save it in logstash output folder as same format "

8

I removed ignore_older option , yet i am not able to reach a solution .

Look, this will take twice as long if I have to ask for additional details every time you ask a question.

My doubt is "Is logstash can really take the .txt or .log files as input from filebeat and save it in logstash output folder as same format "

Yes it can.

9

Thanks Magnus, Will try my best then :slight_smile:

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.