Metricbeat 6.x is not starting (Windows)

Elastic Stack Beats
1

Hi everyone,

i already used Metricbeat for the windows perfmon plugin in version 6.0.0-alpha2 to collect metrics from websites.

now i was trying to replace 6.0.0-alpha2 with the 6.0.1 or 6.1.1 version, but it won't start the service on my Windows 2012 R2 server with an error, that the service wasn't starting fast enough.

Ok then i started to understand what the actual error was, config changes? permissions?..

i went down with my config to a really small version to see if something is broken:

#==========================  Modules configuration ============================
metricbeat.modules:
#------------------------------- System Module -------------------------------

- module: windows
  metricsets: ["perfmon"]
  period: 10s
  perfmon.counters:
    #Cache API values
    - instance_label: "test"
      instance_name: "test2"
      measurement_label: "cache.api.entries"
      query: '\ASP.NET Apps v4.0.30319(_LM_W3SVC_5_ROOT)\Cache API Entries'

still getting the error, what else? ok lets check the output to elasticsearch.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://elastic_cloud_url"]
  index: "myindex-%{+yyyy.MM.dd}"

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  username: "elastic"
  password: "changeme"

looks right (before i changed it for posting it here :smiley: )

Lets disabled it and use the logstash output to localhost:5044 (default setting in metricbeat.yml) and whats going to happen? service started...

now I'm confused...if i let the metricbeat 6.0.0-alpha2 run, then i don't have any problems and receive the events in elastisearch, but after uninstall/install the service for 6.1.1 then i cant start the service.

any idea why this is happening? i also dont get any logs for that failed start, so i cant see what actually is happening with metricbeat 6.x

Would appreciate any help or hint how i can fix it, cause i really want to use the 6.x version instead of the alpha :slight_smile:

Thanks in advance for any help.
Cheers,
Dirk

2

Try starting Metricbeat in the foreground (not as a Windows service).

PS> cd C:\Program Files\Metricbeat
PS C:\Program Files\Metricbeat> .\metricbeat.exe -e -d "*"
1 Like
3

Hi @andrewkroh,

nice now i can actually see an error :slight_smile:

PS C:\Program Files\metricbeat> .\metricbeat.exe -e -d "*"
2018/01/02 16:06:02.913303 metrics.go:23: INFO Metrics logging every 30s
2018/01/02 16:06:02.913303 beat.go:426: INFO Home path: [C:\Program Files\metricbeat] Config path: [C:\Program Files\metricbeat] Data path: [C:\Program Files\metricbeat\data] Logs path: [C:\Program Files\metricbeat\logs]
2018/01/02 16:06:02.914305 beat.go:453: DBG Beat metadata path: C:\Program Files\metricbeat\data\meta.json
2018/01/02 16:06:02.915305 helper_windows.go:19: DBG delete old: remove C:\Program Files\metricbeat\data\meta.json.old:
The system cannot find the file specified.
2018/01/02 16:06:02.916307 helper_windows.go:23: DBG rotate to old: rename C:\Program Files\metricbeat\data\meta.json C:
\Program Files\metricbeat\data\meta.json.old: The system cannot find the file specified.
2018/01/02 16:06:02.916307 beat.go:433: INFO Beat UUID: d3b3885e-7ea2-4f26-bd02-f327a37dd98f
2018/01/02 16:06:02.917310 beat.go:192: INFO Setup Beat: metricbeat; Version: 6.0.1
2018/01/02 16:06:02.917310 beat.go:625: CRIT Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.
Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified.

if you got something about the issue, then im happy to hear it :smiley: otherwise i will look into it tomorrow and update the thread.

Edit: sounds like this direction -> Load the index template in ES

Cheers,
Dirk

4

Ok, i added the two options:

setup.template.name: "myindex"
setup.template.pattern: "myindex-*"

but its not working, if i disable the index option for my custom index name, then it can start without any problems.

i also added the index template as .yml but that also wasnt working

is there something that im missing?

Cheers,
Dirk

5

Please post the full config that you are having trouble with and the latest error message if it's different than above.

As an example here's one of my configs for a customized index name.

setup.template.name: "winlogbeat-%{[beat.version]}"
setup.template.pattern: "winlogbeat-%{[beat.version]}-*"

#================================ Outputs =====================================

output.elasticsearch:
  hosts: [myhost]
  index: "winlogbeat-%{[beat.version]}-%{+xxxx.ww}"
6

oh, i think then i placed the two options at the wrong place...

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["ES_URL:Port"]
  index: "my-index-%{+yyyy.MM.dd}"
  setup.template.name: "my-index"
  setup.template.pattern: "my-index-*"

error was still the same like above

7

Try using:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["ES_URL:Port"]
  index: "my-index-%{+yyyy.MM.dd}"

setup.template.name: "my-index"
setup.template.pattern: "my-index-*"

The indentation you had for those two setup options is wrong.

8

great, that works now :slight_smile:

thanks for the help @andrewkroh

Cheers,
Dirk

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.