Hi, I followed this tutorial "https://www.elastic.co/guide/en/beats/filebeat/5.4/filebeat-getting-started.html" step by step, but Kibana shows me 0 hits and No results found.
Configure filebeat.yml with log file path and map it to ELK server ( single node) in output under filebeat.yml, then give some entry inside log path and check it will get reflected in kibana, there will be 30 sec time out.
your setup is filebeat->Elasticsearch?
Have you had a look at the filebeat log output?
ye, I use filebeat->Elasticsearch. I am really new to this, do you mean logs in
/var/log/filebeat? I don't know which filebeat log output I can refer to.
My filebeat.yml is like:
filebeat.prospectors:
- input_type: log
paths:- /var/log/*.log
output.elasticsearch:
hosts: ["192.168.1.42:9200"]
Is it what you are saying?
yes, /var/log/filebeat contains the filebeats log output.
My log file is like this:
2017-07-04T15:14:50-04:00 INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017-07-04T15:14:50-04:00 INFO Setup Beat: filebeat; Version: 5.4.3
2017-07-04T15:14:50-04:00 INFO Loading template enabled. Reading template file: /etc/filebeat/filebeat.template.json
2017-07-04T15:14:50-04:00 INFO Metrics logging every 30s
2017-07-04T15:14:50-04:00 INFO Loading template enabled for Elasticsearch 2.x. Reading template file: /etc/filebeat/filebeat.template-es2x.json
2017-07-04T15:14:50-04:00 INFO Loading template enabled for Elasticsearch 6.x. Reading template file: /etc/filebeat/filebeat.template-es6x.json
2017-07-04T15:14:50-04:00 INFO Elasticsearch url: http://192.168.1.42:9200
2017-07-04T15:14:50-04:00 INFO Activated elasticsearch as output plugin.
2017-07-04T15:14:50-04:00 INFO Publisher name: wenbo-VirtualBox
2017-07-04T15:14:50-04:00 INFO Flush Interval set to: 1s
2017-07-04T15:14:50-04:00 INFO Max Bulk Size set to: 50
2017-07-04T15:14:51-04:00 INFO filebeat start running.
2017-07-04T15:14:51-04:00 INFO Registry file set to: /var/lib/filebeat/registry
2017-07-04T15:14:51-04:00 INFO Loading registrar data from /var/lib/filebeat/registry
2017-07-04T15:14:51-04:00 INFO States Loaded from registrar: 2
2017-07-04T15:14:51-04:00 INFO Loading Prospectors: 1
2017-07-04T15:14:51-04:00 INFO Prospector with previous states loaded: 0
2017-07-04T15:14:51-04:00 INFO Starting prospector of type: log; id: 1462193845342389316
2017-07-04T15:14:51-04:00 INFO Loading and starting Prospectors completed. Enabled prospectors: 1
2017-07-04T15:14:51-04:00 INFO Start sending events to output
2017-07-04T15:14:51-04:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
2017-07-04T15:14:51-04:00 INFO Starting Registrar
2017-07-04T15:14:52-04:00 INFO Harvester started for file: /home/wenbo/Desktop/Tap-News/web_server/logs/main.log
2017-07-04T15:15:16-04:00 INFO Non-zero metrics in the last 30s: filebeat.harvester.open_files=1 filebeat.harvester.running=1 filebeat.harvester.started=1 libbeat.publisher.published_events=10
2017-07-04T15:15:46-04:00 INFO No non-zero metrics in the last 30s
2017-07-04T15:16:16-04:00 INFO No non-zero metrics in the last 30s
2017-07-04T15:16:21-04:00 ERR Connecting error publishing events (retrying): Get http://192.168.1.42:9200: net/http: request canceled while waiting for connection
2017-07-04T15:16:46-04:00 INFO No non-zero metrics in the last 30s
2017-07-04T15:17:16-04:00 INFO No non-zero metrics in the last 30s
2017-07-04T15:17:46-04:00 INFO No non-zero metrics in the last 30s
2017-07-04T15:17:52-04:00 ERR Connecting error publishing events (retrying): Get http://192.168.1.42:9200: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
2017-07-04T15:18:16-04:00 INFO No non-zero metrics in the last 30s
2017-07-04T15:18:46-04:00 INFO No non-zero metrics in the last 30s
2017-07-04T15:19:16-04:00 INFO No non-zero metrics in the last 30s
See error message:
Get http://192.168.1.42:9200: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
Seems to be a problem with Elasticsearch. Either it's not running (correctly) or not at all.
You can try to increase the output.elasticsearch.timeout: 60s from default to 60s to much some higher value. But ultimately you want need to check Elasticsearch being available.
Have you tried curl http://192.168.1.42:9200 ?
Ye, I have tried 'curl http://192.168.1.42:9200 ', it works fine.
have you tried to increase the timeout?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.