Systemctl start filebeat does not start filebeat

Elastic Stack Beats
1

after changing some configuration
(I added
json.message_key: message
json.keys_under_root: true
)
and doing restart to filebeat, filebeat refuses to start
with nothing showing on the logs...

2

Problem was solved (somehow it just started after about an half an hour of retries)

3

When changing config it is useful to run the config test with:

filebeat.sh -e -configtest

And when dealing with failures you can run Filebeat in the foreground to see all log output:

filebeat.sh -e -d "*"

(-d "*" enables debug logging)

1 Like
4

Thanks @andrewkroh, this will help me in future configuration!

By any chance do you know if logstash has a feature such as:
filebeat.sh -e -configtest (I tried logstash.sh -e -configtest but with no success)

5

I think the equivalent for LS is

/usr/share/logstash/bin/logstash --configtest -f <config file or dir>

1 Like
6

Note that starting with Logstash 5.0, the --configtest option was renamed to --config.test_and_exit. So the command for testing the config file with version 5.0 and later would look something like this:

path/to/bin/logstash -f configfile --config.test_and_exit

See https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html

1 Like
7

This topic was automatically closed after 21 days. New replies are no longer allowed.