Problems logstash directory - link with FBeat

Hi

THANK YOU FOR YOUR HELP ! My message is to long but this really short in reality :slight_smile: (I'm french who write you !)

I have a problems with installation and configuration to Logstash and Fbeat.

I have follow the started from officiel website (https://www.elastic.co/guide/en/logstash/5.1/getting-started-with-logstash.html)

ElasticS : OK
Kibana ; OK.

Logstash : NOK
FileBeat : NOK (effect of NOK logstash)

So, for logstash :

rpm --install logstashxxxxx5.1

cd logstash-5.1.1 : NOK (doesn't match)

To perform this test command : "./logstash -e 'input { stdin { } } output { stdout {} }'", I must GO IN DIRECTORY : "/usr/share/logstash/bin/"

And, this is result :

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults

Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console

The stdin plugin is now waiting for input:
17:01:34.513 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}

17:01:34.543 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
17:01:34.679 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}

FOR FileBeat :

rpm -vi filebeat-5.1.1-x86_64.rpm

vi /etc/filebeat/filebeat.yml : I change juste Logstash output.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
hosts: ["localhost:9200"]

#----------------------------- Logstash output --------------------------------
hosts: ["10.162.188.102:5044"]

To test my configuration with this command : "/filebeat.sh -configtest -e" , I must go in DIRECTORY :"/usr/share/filebeat/bin" and execute this : "filebeat.sh -configtest -e"

=>
2017/01/09 16:10:15.677410 beat.go:267: INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2017/01/09 16:10:15.677495 beat.go:177: INFO Setup Beat: filebeat; Version: 5.1.1
2017/01/09 16:10:15.677684 output.go:167: INFO Loading template enabled. Reading template file: /etc/filebeat/filebeat.template.json
2017/01/09 16:10:15.677848 logp.go:219: INFO Metrics logging every 30s
2017/01/09 16:10:15.678096 output.go:178: INFO Loading template enabled for Elasticsearch 2.x. Reading template file: /etc/filebeat/filebeat.template-es2x.json
2017/01/09 16:10:15.678415 client.go:120: INFO Elasticsearch url: http://10.162.188.102:5044
2017/01/09 16:10:15.678503 outputs.go:106: INFO Activated elasticsearch as output plugin.
2017/01/09 16:10:15.678621 publish.go:291: INFO Publisher name: opmaic41
2017/01/09 16:10:15.678882 async.go:63: INFO Flush Interval set to: 1s
2017/01/09 16:10:15.678927 async.go:64: INFO Max Bulk Size set to: 50
Config OK

So, to link with logstash (and no with elastic), i follow this link (https://www.elastic.co/guide/en/beats/libbeat/5.1/logstash-installation.html#logstash-setup)

In first, my logstash isn't in /opt/logstash.....

To execute : "./bin/logstash-plugin install logstash-input-beats" , i go in "/usr/share/logstash/bin" :

=> logstash-plugin install logstash-input-beats
bash: logstash-plugin: command not found

...... so bad :sleepy:

I see i haven't any file in /etc/logstash/conf.d/

My paths are wrong mayby, i need help ... :frowning:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.