Postgres module and altered log_line_prefix

Elastic Stack Beats
1

Hi,
Does filebeat take into account when the log_line_prefix is altered and the postgres module is loaded?

i'm getting:
Provided Grok expressions do not match field value:

Do I need to change the grok patern and how do I do this?

2

Hi! I'm not sure what you're trying to do here, could you share your filebeat configuration for troubleshooting?

3

filebeat.yml

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

output:

  elasticsearch:
    username: cencored
    password: cencored
    hosts: ["https://cencored1:9200","https://cencored2:9200","https://cencored3:9200"]
    ssl.certificate_authorities: "/etc/filebeat/config/certs/cencored.pem"
    ssl.certificate: "/etc/filebeat/config/certs/cencored.cer"
    ssl.key: "/etc/filebeat/config/certs/cencored.key"
    tls:
      certificate_authoritie: "/etc/filebeat/config/certs/cencored.pem"
      certificate: "/etc/filebeat/config/certs/cencored.cer"
      certificate_key: "/etc/filebeat/config/certs/cencored.key"
shipper:
logging:
  files:
    rotateeverybytes: 10485760 # = 10MB
    keepfiles: 7

setup.kibana:
  host: "https://cencored:443"

xpack.monitoring:
  enabled: true
  elasticsearch:
    username: aascoussens_local
    password: watjes2006
    hosts: ["https://cencored1:9200","https://cencored2:9200","https://cencored3:9200"]
    ssl.certificate_authorities: "/etc/filebeat/config/certs/cencored.pem"
    ssl.certificate: "/etc/filebeat/config/certs/cencored.cer"
    ssl.key: "/etc/filebeat/config/certs/cencored.key"
    tls:
      certificate_authoritie: "/etc/filebeat/config/certs/cencored.pem"
      certificate: "/etc/filebeat/config/certs/cencored.cer"
      certificate_key: "/etc/filebeat/config/certs/cencored.key"

/etc/filebeat/modules.d/postgresql.yml

- module: postgresql
  log:
    enabled: true
     var.paths: ["/censored/main/pg_log/*.log"]
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.