Running on Windows - Not logging Kibana

Elastic Stack Beats
1

Hello,
I was running filebeat on linux and forwarding the logs to logstash
I then deleted the Linux one and installed one on Windows.
I then started the service and it ran fine, then I checked on Kibana it was only displaying the Linux logs but not properly:

image
image.png2932×200 15 KB

This is my filebeat config:

#=========================== Filebeat inputs =============================
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - C:\Windows\System32\winevt\Logs\*
#============================= Filebeat modules ===============================

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
#==================== Elasticsearch template setting ==========================
setup.template.settings:
  index.number_of_shards: 3
#============================== Dashboards =====================================
setup.dashboards.enabled: true
#============================== Kibana =====================================
setup.kibana:
  host: "ip:5601"
#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts: ["ip:5044"]

Any clues to why its not logging the logs I set it to log and instead its still showing Linux ones?
Note: I already deleted all filebeat logs with the following command:

PowerShell.exe Invoke-RestMethod -Method Delete http://10.130.233.242:9200/filebeat-*

Therefore, I have no idea to why it still showing.

edit1: something really weird is happening. I can run filebeat fine on Powershell, but when I go to services.msc it says its not running and if I try to run from there it says: Windows could not start the filebeat service on Local Computer.

edit2: fixed the issue by running these commands on Dev Tools:

 PUT _settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }
    
PUT filebeat-6.3.1-2018.07.18/_settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }
    
PUT filebeat-*/_settings
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }

The only issue is that Filebeat is not displaying anything on Kibana Discover, its almost like it's not selecting anything:

image
image.png2912×198 16.2 KB

and i've put a year to date on time range. So it should be display something. If I go to Managemenet and select filebeat-* it doesn't even select filebeat:
image
Then if I try to index anything on filebeat, for example todays logs. It gives me this:
image
image.png748×59 4.43 KB

and the same goes for Logstash. Winlogbeat works fine though.

edit3: This is what it says when I try to open FIlebeat on discover:

blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];

 Less Info
OK
Error: blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];: [cluster_block_exception] blocked by: [FORBIDDEN/12/index read-only / allow delete (api)];
    at http://ip:5601/bundles/commons.bundle.js:3:428829
    at processQueue (http://10.130.233.242:5601/bundles/vendors.bundle.js:133:134252)
    at http://ip:5601/bundles/vendors.bundle.js:133:135201
    at Scope.$digest (http://ip:5601/bundles/vendors.bundle.js:133:146077)
    at Scope.$apply (http://ip:5601/bundles/vendors.bundle.js:133:148856)
    at done (http://ip:5601/bundles/vendors.bundle.js:133:101124)
    at completeRequest (http://ip:5601/bundles/vendors.bundle.js:133:106024)
    at XMLHttpRequest.xhr.onload (http://ip:5601/bundles/vendors.bundle.js:133:106783)
2

It sounds like there are some permissions issues going on. Can you post the results ofGET 'http://localhost:9200/_settings' and GET 'http://localhost:9200/filebeat-*/_settings' (you can use the console in the kibana dev tools to do this).

It might also be interesting to try shipping data to a fresh ES install. My guess is that there's some bad setting remaining, probably the read_only setting. My guess is that you weren't able to successfully reset that, or that some other process is overwriting your manual changes.

3

This could also be ES running low on disk space. Have you checked the ES logs?

ES will continue to put these indices into a closed state if you're running close to your disk limits.

4

Sorry for the late reply, but I was able to get filebeat to read those logs. Problem is... this is what it is displaying:

image
image2928×946 175 KB

is this normal? I was expecting it to read it like the event viewer logs

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.