Pipelines don't working

Elastic Stack Logstash
1

I want to log two separate servers that each has filebeat installed.
this is my pipeline:

- pipeline.id: beats-server
  config.string: |
    input { beats { port => 5400 } }
    output {
        if [source] == 'src' {
          pipeline { send_to => src }
        } 
    }

- pipeline.id: src-pr
  path.config: "/etc/logstash/conf.d/pipelines/addr.conf"

and this is the config file:

input {
    pipeline {
        address => src
    }
}

filter {
  json {
    source => "message"
    target => "message"
  }
}

output {
    if [log][file][path] =~ "/var/logs/xxx/" {
      elasticsearch {
    hosts => "127.0.0.1:9200"
    index => "idx"
    user => "xxxx"
    password => "xxxx"
      }
   }
}

the service starts successfully but logs cannot shown in kibana.

2

What in your filebeat configuration makes you think those conditionals will evaluate to true?

3

if I run logstash without pipeline everything is good. this is the filebeat configuration:

filebeat.inputs:

- type: filestream
  fields:
    source: 'src'
  enabled: true
  paths:
    - /var/logs/xxx/*.log
4

finally I solved the problem with adding

fields_under_root: true

in filebeat configuration.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.