Multiple prospector path


#1

Hey,

i want to use 2 prospectors, filebeal.yml is working perfect with just one;

However, if i uncomment the 2nd prospector, the filebeat fails to start:


After some trial and error i figured out that if i change the path of the 2nd prospector to anything else that doesn't have the same first folder (coriant), filebeat starts normally. Why is this happening?


(ruflin) #2

Can you share your config file in text format instead of screen shots? This makes it easier to read.

  • Did you have 2 prospectors with the same files to harvest?
  • Which filebeat version are you using?
  • Can you provide some log outputs from filebeat?

#3

Hey, thank you for your help, here is what you requested:

  prospectors:
# Each - is a prospector. Below are the prospector specific configurations
-
  # Paths that should be crawled and fetched. Glob based paths.
  # To fetch all ".log" files from a specific level of subdirectories
  # /var/log/*/*.log can be used.
  # For each file found under this path, a harvester is started.
  # Make sure not file is defined twice as this can lead to unexpected behaviour.
  paths:
  - "/coriant/sdn/logs/tc/Heap_Logs/*"
  #- c:\programdata\elasticsearch\logs\*
  input_type: log
  fields:
    log_type: heap
-
paths:
- "/coriant/sdn/logs/tc/GC_Logs/*"
input_type: log
fields:
log_type: GC
  • 2 prospectors to different files (One to Heap_Logs, another to GC_Logs)

  • im using filebeat 1.3

  • here is the logging from filebeat, i havent seen it before, but still i dont understand what it meants, the file path is working fine for the first prospector but not for the second even though they are very similar

          2016-10-28T10:12:06+01:00 CRIT Config error: Error reading config file: YAML config parsing failed on          /etc/filebeat/filebeat.yml: yaml: unmarshal errors:
        line 148: cannot unmarshal !!str `/corian...` into config.ProspectorConfig. Exiting.

(ruflin) #4

Yaml is quite picky about the indentation (only spaces, no tabs). The above config file you posted looks like there are quite a few issues with the indentation. Best is to take the original config file and add your own values.


#5

yeah i suspected it was that but i ve been doing this config file over and over. Maybe im doing always the same mistake. Will keep trying until YAML gets in better mood and accepts it. Thank you


(system) #6

This topic was automatically closed after 21 days. New replies are no longer allowed.