Not able to start, remove the filebeat

Elastic Stack Beats
1

Hi, so i have ansible playbook install filebeat agent on a server. After installation, i went to check the service and it was working fine. But then i manually stopped the service and starting again, afterwards i have getting the Active: failed (Result: start-limit) error even if i run the playbook again with deleting all the files and folders of filebeat. Please advise.

$ service filebeat status
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Fri 2019-11-15 10:26:48 MST; 23s ago
Docs: https://www.elastic.co/products/beats/filebeat
Process: 7545 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
Main PID: 7545 (code=exited, status=1/FAILURE)

Here is the filebeat.yml

############################# Filebeat ######################################

filebeat.registry_file: /var/lib/filebeat/registry
filebeat.config_dir: /etc/filebeat/conf.d

############################# Output ##########################################

output.logstash.hosts: ["#hostnameA:5044", "#hostnameB:5044"]
output.logstash.loadbalance: true
output.logstash.index: filebeat

############################# Logging #########################################

logging.level: info
logging.to_files: false
logging.to_syslog: true
logging.metrics.enabled: true
logging.metrics.period: 5m
logging.files.path: /var/log/filebeat
logging.files.rotateeverybytes: 10485760
logging.files.keepfiles: 7

2

i have attached the partial log when i run $ filebeat -v -e -d "*"

INFO instance/beat.go:280 Setup Beat: filebeat; Version: 6.8.0
DEBUG [beat] instance/beat.go:301 Initializing output plugins
DEBUG [processors] processors/processor.go:66 Processors:
DEBUG [publish] pipeline/consumer.go:137 start pipeline event consumer
INFO [publisher] pipeline/module.go:110 Beat name: #hostname.domain.com
WARN [cfgwarn] config/config.go:132 DEPRECATED: config_dir is deprecated. Use filebeat.config.inputs instead. Will be removed in version: 7.0.0
INFO config/config.go:138 Additional config files are fetched from: /etc/filebeat/conf.d
INFO instance/beat.go:359 filebeat stopped.
ERROR instance/beat.go:906 Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?
Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch?

3

@newafounder: I too may have faced a similar problem after upgrading to latest version (7.4).

The is a module foldr and the contents are below (ls module/)
apache auditd haproxy iis kibana mongodb nats osquery redis system
apache2 elasticsearch icinga kafka logstash mysql nginx postgresql santa traefik

The module folder used to be inside /usr/share/filebeat/bin and with latest release it is expected to be outside of bin folder (/usr/share/filebeat).

Please try it and see if it works

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.