Remote filebeat ingest pipeline working with logstash

Elastic Stack Logstash
1

Hi
i have installed logstash 7.4.1 in my vmware and elasticsearch 7.4.1 . besides that i have installed filebeat 7.4.1 in a remote machine and want to send logs with apache module pipeline into my logstash.then logstash send logs to elasticsearch and make an index. my problem is when i run pipeline with the command "./filebeat setup --pipelines --modules apache" and start all services there is no index in elasticsearch.
i set my logstash ip and port in remote filebeat.yml and disable elasticsearch output . following lines are the content of logstash configuration file
input {
beats {
port => 5044
host => "0.0.0.0"
}
}

output {
if [@metadata][pipeline] {
elasticsearch {
hosts => "127.0.0.1:9200"
manage_template => false
index => "apache-%{[@metadata][version]}-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
}
} else {
elasticsearch {
hosts => "127.0.0.1:9200"
manage_template => false
index => "atefeh-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
}

2

In order to setup pielines you need direct Elasticsearch connection. Try this:

filebeat setup --pipelines -e --modules apache \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['https://redacted:9200'] \
  -E output.elasticsearch.username=redacted \
  -E output.elasticsearch.password=redacted
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.