On centos 7, I've installed logstash, and beats via the repo mentioned in the docs. The very first test at "https://www.elastic.co/guide/en/logstash/current/first-event.html" works.
Now I'm trying "https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html" Beats and Logstash start (i think) without error. Port 5044 is listening. Yet I don't see any of the log records echoed to stdout in the console where logstash is running.
What am I doing wrong? How to debug?
Alright. Basically the tutorial skips settings you need!
In the filebeat.yml file, filebeat.inputs section, change
enable: false
to
enabled: true
Comment out
output.elasticsearch:
Comment out
hosts: ["localhost:9200"]"
in output.elasticsearch section.
Make sure "output.logstash:" is not commented out, and make sure it has
hosts: ["localhost:5044"]
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.