Topbeat doesn't send metrics to Logstash in client-server architecture

Elastic Stack Beats
1

Hi all,

I just set up topbeat following the documentation. But I can't have metrics of my cluster in logstash. I use a client-server architecture (i.e a client with Topbeat configured and installed and a server with logstash and elasticsearch) The client and the server are not in the same subnet so I used domain name to reach logstash in the Server instance.

Here is my /etc/topbeat/topbeat.yml config file:

input: period: 10 procs: [".*"] stats: system: true proc: true filesystem: true cpu_per_core: false output: logstash: hosts: ["topbeatdomainname:5044"] index: topbeat
And on logstash side, I just configured a logstash.conf file under /etc/logstash/conf.d/logstash.conf:

`input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => "172.31.62.244:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
`
So nothing special. But what am I missing??

Many thanks!!

2

Check your Topbeat logs for clues.

3

Thanks for responding. I don't know where are topbeat logs. I expected it to be on /var/log/topbeat but I don't have it here. Do you know where I can see them?

4

If you start Topbeat with -e you'll get the logs to stderr. Otherwise see the logging configuration you have in topbeat.yml.

https://www.elastic.co/guide/en/beats/topbeat/current/configuration-logging.html

5

Thank you for the logging stuff. But there is no entry in the log file. I configured the logging and set the level to error. But the log file is not created when restarting the service. Do you think I need t use certificates in the yml file?

6

Not unless you want to use SSL, which you AFAICT haven't configured. Maybe the configuration is incorrect. If you post it here (formatting the whole file as code with the </> toolbar button) maybe we can spot the error. Alternatively, use the -e option to get logs to stderr.

7

Ok issue solved as you said it was due to improper configuration. Also tls was not necessary. Thank you for your great help!!!