I'd like to debug processing of events by production filebeat.yml trying to redirect input and output for filebeat to console. Input can be redefined by -E with no problems but output redirection is fairly impossible.
Assuming filebeat.yml like
...
output: logstash.hosts: [ 'host:port' ]
...
if we run
filebeat -E 'output={console:{pretty:true}}'
we encounter error about 'more than one output'. In my opinion this -E should override whole definition of output, but seems only merge to one in .yml file. Is this bug in -E application? Is there any other possibility of redirection of output with no modification to original .yml file
In my opinion, for sure, this is not bug related to 'output' behavior, but maybe bug to overriding the config. One could think that -E path={object def} should redefine whole config object pointed by path (i.e. deleting other props defined in .yml), and not only append {object def} to it. For some configurations this could be crucial.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.