Porspector and harvester


(Bruno Ramos Dias) #1

Somethins seems to be wrong on my configurations of filebat on to logsstash

This is my log when running file beat pointed at a logstash on another server:

2018-01-29T15:48:06-03:00 DBG [prospector] Harvester for file is still running: [confidential].log
2018-01-29T15:48:06-03:00 DBG [prospector] Prospector states cleaned up. Before: 1, After: 1
2018-01-29T15:48:11-03:00 DBG [harvester] End of file reached:[confidential].log;
Backoff now.
2018-01-29T15:48:15-03:00 INFO Non-zero metrics in the last 30s: beat.info.uptime.ms=30000 beat.memstats.gc_next=4194304 beat.memstats.memory_alloc=1497552 beat.memstats.memory_total=54425192 filebeat.harvester.open_files=1 filebeat.harvester.running=1 libbeat.config.module.running=0 libbeat.pipeline.clients=1 libbeat.pipeline.events.active=0 registrar.states.current=1
2018-01-29T15:48:16-03:00 DBG [prospector] Run prospector
2018-01-29T15:48:16-03:00 DBG [prospector] Start next scan

this is my logstash initialization log:
[2018-01-29T09:22:37,705][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//localhost:9200"]}
[2018-01-29T09:22:38,107][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125, :thread=>"#<Thread:0x5348aea9@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:245 run>"}
[2018-01-29T09:22:39,132][INFO ][logstash.inputs.beats ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2018-01-29T09:22:39,967][INFO ][logstash.pipeline ] Pipeline started {"pipeline.id"=>"main"}
[2018-01-29T09:22:39,982][INFO ][logstash.agent ] Pipelines running {:count=>1, :pipelines=>["main"]}
[2018-01-29T09:22:40,022][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2018-01-29T09:22:42,747][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[http://localhost:9200/], :added=>[http://127.0.0.1:9200/]}}
[2018-01-29T09:22:42,748][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://127.0.0.1:9200/, :path=>"/"}
[2018-01-29T09:22:42,754][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://127.0.0.1:9200/"}

I have also created the filebeat template on elasticsearch but no indexes are generated
can anyone point me what could be wrong?


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.