Setup filebeat module

Elastic Stack Beats
,
1

I'm trying to set up the apache module in filebeat. I output filebeat to logstash. Just for some context I've enabled pipelines with this command:

filebeat setup --pipelines --dashboards --modules apache -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["https://elastic:password@202.71.11.11:9200"]' -E output.elasticsearch.ssl.certificate_authorities=/etc/beats/http2.crt

I've set up the /modules.d/apache.yml with these settings.

When I start filebeat, I get this message:

{"level":"info","timestamp":"2020-09-06T06:58:58.574Z","logger":"monitoring","caller":"log/log.go:131","message":"Stopping metrics logging."}
{"level":"info","timestamp":"2020-09-06T06:58:58.574Z","caller":"instance/beat.go:456","message":"filebeat stopped."}
{"level":"error","timestamp":"2020-09-06T06:58:58.574Z","caller":"instance/beat.go:951","message":"Exiting: Failed to start crawler: creating module reloader failed: Error getting config for fileset apache/access: Error interpreting the template of the input: template: text:3:22: executing \"text\" at <.paths>: range can't iterate over /var/log/httpd/access_log*"}
Exiting: Failed to start crawler: creating module reloader failed: Error getting config for fileset apache/access: Error interpreting the template of the input: template: text:3:22: executing "text" at <.paths>: range can't iterate over /var/log/httpd/access_log*

The path /var/log/httpd/access_log* does exist though:

]# ll /var/log/httpd/access_log*
-rw-r--r-- 1 root root     0 Sep  6 03:48 /var/log/httpd/access_log
-rw-r--r-- 1 root root  4948 Aug 15 08:17 /var/log/httpd/access_log-20200816
-rw-r--r-- 1 root root  5837 Aug 21 14:20 /var/log/httpd/access_log-20200823
-rw-r--r-- 1 root root  3867 Aug 29 13:13 /var/log/httpd/access_log-20200830
-rw-r--r-- 1 root root 16917 Sep  3 15:06 /var/log/httpd/access_log-20200906
2

Try to use this synatxe

 var.paths:
      - '/var/log/httpd/access_log*'
1 Like
3

Thanks for the response,

Getting the same result.

4

SOLVED:

Has solved the issue! for some VERY strange reason it only accepts arrays?

5

Yes only array

1 Like
6

I'm sorry you were right. I'm an idiot. I copied your syntax wrong. I just put ' around it. Didn't notice you did it as an array.

Thank you. Changed your answer to be the solution.

7

You're welcome, this is always happens with yaml files :slight_smile:

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.