Hello,
i have 2 Servers (one is ELK and other is filebeat ) both are Centos 7.
i have installed ELK 5.4 "tar installation" on 1st server and filebeat 5.4 "tar installation" on 2nd server. i can see the log index in my Kibana discovery but when i switch to the visualize or the dashboard tab show me (No results found).
Also i have installed Xpack plugin for ELasticsearch and Kibana but made the (xpack.security.enabled: false) for both
***my logstash (input/filter/output) file "/usr/local/logstash/logstash.conf"
###################### <! INPUT !> ###############################
input {
beats {
port => 5044
}
stdin {
type => "stdin-type"
}
file {
type => "syslog"
# Wildcards work, here :)
path => [ "/var/log/message", "/var/log/secure" ]
start_position => "beginning"
}
file {
type => "apache"
path => [ "/usr/local/apache/logs//.log", "/usr/local/apache/logs/*_log" ]
start_position => "beginning"
}
}
####################### <! FILTER!> ##############################
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
filter {
if [path] =~ "access" {
mutate { replace => { "type" => "apache_access" } }
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
output {
stdout {codec => rubydebug}
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
***my filebeat conf file (/usr/local/filebeat/filebeat.yml)
#========================== Modules configuration ============================
#filebeat.modules:
##------------------------------- System Module -------------------------------
modules:
2017/06/15 01:00:42.061635 metrics.go:34: INFO No non-zero metrics in the last 30s
- name: mysql
- name: syslog
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
Each - is a prospector. Most options can be set at the prospector level, so
you can use different prospectors for various configurations.
Below are the prospector specific configurations.
-
input_type: log
Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/messages
- /var/log/secure
#- c:\programdata\elasticsearch\logs*
-
input_type: log
paths:- /usr/local/apache/logs//.log
- /usr/local/apache/logs/*_log
fields:
apache: true
fields_under_root: true
#----------------------------- Logstash output --------------------------------
output.logstash:
The Logstash hosts
hosts: ["ELK_server_IP:5044"]
could u plz help me, i have spent 3 days searching on this issue but i didn't find anything valued 
.