I am using Metricbeat 5.2.2 on a Ubuntu 14.04.05 LTS 64 bit trying to run metricbeat configtest from the /usr/share/metricbeat/bin directory as:
sudo ./metricbeat -c /etc/metricbeat/metricbeat.yml -configtest
However, I get the following error reported:
Exiting: error initializing publisher: Error loading template /usr/share/metricbeat/bin/metricbeat.template.json: open /usr/share/metricbeat/bin/metricbeat.template.json: no such file or directory
My /etc/metricbeat directory does include the template files as well:
ls /etc/metricbeat
metricbeat.full.yml metricbeat.template-es2x.json metricbeat.template.json metricbeat.yml
My metricbeat.yml files is:
###################### Metricbeat Configuration Example #######################
# This file is an example configuration file highlighting only the most common
# options. The metricbeat.full.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/metricbeat/index.html
#========================== Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------
- module: system
metricsets:
# CPU stats
- cpu
# System Load stats
- load
# Per CPU core stats
- core
# IO stats
- diskio
# Per filesystem stats
- filesystem
# File system summary stats
- fsstat
# Memory stats
- memory
# Network stats
- network
# Per process stats
- process
# Sockets (linux only)
- socket
enabled: true
period: 10s
processes: ['.*']
cgroups: true
filters:
drop_event:
system.process.cgroup.memory.kmem.limit.bytes
#================================ General =====================================
# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:
# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]
# Optional fields that you can specify to add additional information to the
# output.
#fields:
# env: staging
#================================ Outputs =====================================
# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["192.168.0.40:9200"]
template.name: "metricbeat"
template.path: "metricbeat.template.json"
template.overwrite: true
# Optional protocol and basic auth credentials.
#protocol: "https"
#username: "elastic"
#password: "changeme"
#----------------------------- Logstash output --------------------------------
#output.logstash:
# The Logstash hosts
#hosts: ["localhost:5044"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
#logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
I also can't seem to get the filters: stanza to actually drop an offending event as it continues to end up in the /var/log/metricbeat/metricbeat file with an error:
2017-05-11T14:53:28Z WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse [system.process.cgroup.memory.kmem.limit.bytes]","caused_by":{"type":"json_parse_exception","reason":"Numeric value (18446744073709551615) out of range of long (-9223372036854775808 - 9223372036854775807)\n at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@5996f58a; line: 1, column: 1103]"}}
None of the other cgroup processes are indicated as failing, but none of them show up in my index either. I have deleted my index and repushed the template even though it looked the same as the one that was registered on Elasticsearch.
Any ideas on how to fix these two issues - the first was found because I was troubleshooting the second.
Thanks.
