New to elastic having issue with file beat

(Ronald Hill) #1
  • Restarting Sends log files to Logstash or directly to Elasticsearch. filebeat 2016/01/07 00:17:05.443037 outputs.go:105: ERR failed to initialize elasticsearch plugin as output: no host configuration found
    Error Initialising publisher: no host configuration found
    2016/01/07 00:17:05.443131 beat.go:101: CRIT no host configuration found

help pls

(Mark Walkom) #2

Providing your config will help us help you.

(Ronald Hill) #3
     - /var/log/auth.log
     - /var/log/syslog

- /var/log/*.log


document_type: syslog


Elasticsearch as output

enabled: false

Logstash as output

# The Logstash hosts
hosts: ["10.x.x.x:5044"]

# List of root certificates for HTTPS server verifications
certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]

(Mark Walkom) #4

Is that the whole thing? Why are there so many ... sections?

The error specifically says [quote="Ronald_Hill, post:1, topic:38560"]
no host configuration found
for your ES section, so providing all of that would be useful.

(Ronald Hill) #5

well i followed the configuration on

maybe thats my first issue

(Mark Walkom) #6

That link doesn't exist.

(Ronald Hill) #7

(Ronald Hill) #8

I followed all the steps and the only error im getting is with filebeat.yml i know its something simple that im missing but i cant see what it is. thanks

(Mark Walkom) #9

As mentioned, it'd help if you posted/linked to your complete filebeat config.
If you don't want to post that then just the entire output section.

(Andrew Kroh) #10

The tutorial you followed is not up to date. Follow our official getting-started guide.

The enabled: false and enabled: true options were removed while Filebeat was in beta. They are not present in the configuration file shipped with Filebeat. You should either comment out or remove the outputs that you are not using (i.e. elasticsearch, file, console). Here is the documentation for all of the configuration options for Filebeat 1.0.1.

(system) #11