Output logstash problem in filebeat 7.2

Elastic Stack Beats
1

filebeat.yml:

filebeat.inputs:

  • type: log
    enabled: false
    paths:

    • /var/log/*.log

    #- c:\programdata\elasticsearch\logs*

filebeat.registry.path: /var/lib/filebeat/registry
filebeat.registry.file_permissions: 0600
filebeat.shutdown_timeout: 5s

filebeat.config.modules:
path: /etc/filebeat/modules.d/*.yml
reload.enabled: true

setup.template.overwrite: true
setup.template.enabled: false
setup.template.settings:
index.number_of_shards: 3
index.number_of_replicas: 3

setup.dashboards.enabled: true

setup.kibana:
host: "192.168.90.10:5601"

output.elasticsearch:
hosts: ["192.168.90.10:9200"]
tls:
certificate_authorities: "/etc/pki/tls/certs/elk-test.crt"

logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644
rotateeverybytes: 10485760 # = 10MB

Then I run
filebeat setup
filebeat -e
service filebeat restart

It works properly.

I need to analysis some custom path logs and modules path logs both. for this I reconfigure filebeat like below.

filebeat.inputs:

  • type: log
    enabled: false
    paths:

    • /var/log/*.log

    #- c:\programdata\elasticsearch\logs*

filebeat.registry.path: /var/lib/filebeat/registry
filebeat.registry.file_permissions: 0600
filebeat.shutdown_timeout: 5s

filebeat.config.modules:
path: /etc/filebeat/modules.d/*.yml
reload.enabled: true

setup.template.overwrite: true
setup.template.enabled: false
setup.template.settings:
index.number_of_shards: 3
index.number_of_replicas: 3

setup.dashboards.enabled: true

setup.kibana:
host: "192.168.90.10:5601"

output.logstash:
hosts: ["192.168.90.10:5044"]
ssl.certificate_authorities: "/etc/pki/tls/certs/elk-test.crt"

logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644
rotateeverybytes: 10485760 # = 10MB

But it doesn't work. Please help me.

2

Please properly format logs and configurations files using the </> button in the editor window.

What doesn't work? Do you get any error message? Can you share debug logs (run filebeat with -d *)?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.