Unable to parse files to logstash

(Shaswata Bisi) #1

hi. I am new to elastic search. I tried to send log files through file beat into the logstash but I am not getting any outcome in the console. my configuration file is as follows

input {
beats {
host => ""

The port to listen on

port => "5044"

	# The paths to your ssl cert and key
	#ssl_certificate => "D:/ELK stack with OS metrics/sslnew/lumberjack.crt"
	#ssl_key => "D:/ELK stack with OS metrics/sslnew/lumberjack.key"

	# Set this to whatever you want.
	#type => "osmetrics"


filter {

csv {
separator => ","
columns => ["Timestamp",
"Memory-% Committed Bytes In Use",
"Memory-Available Bytes",
"Memory-Available KBytes",
"Memory-Available MBytes",
"Memory-Page Faults/sec",
"Memory-Free System Page Table Entries",
"PhysicalDisk(_Total)-Avg. Disk Bytes/Read",
"PhysicalDisk(_Total)-Avg. Disk Bytes/Write",
"PhysicalDisk(_Total)-Current Disk Queue Length",
"PhysicalDisk(_Total)-Disk Read Bytes/sec",
"PhysicalDisk(_Total)-Disk Write Bytes/sec",
"Process(_Total)-% Processor Time",
"Process(_Total)-% User Time",
"Process(_Total)-ID Process",
"Process(_Total)-Thread Count",
"Process(_Total)-Working Set",
"Process(_Total)-IO Read Bytes/sec",
"Process(_Total)-IO Write Bytes/sec",
"Processor(_Total)-% Idle Time",
"Processor(_Total)-% Processor Time",
"Processor(_Total)-% User Time"]

#if [host] == "INHYICBIVM005"{

mutate {
update => { "host" => "Informatica_Server" }
#if [host] == "INHYICBIVM003"{

mutate {
update => { "host" => "Datastage_Server" }
#if [host] == "INHYICBIVM008"{

mutate {
update => { "host" => "Qlikview_Server" }
#if [host] == "INHYICBIVM011"{

mutate {
update => { "host" => "SSIS_SSRS_Server" }

output {
elasticsearch {
hosts=> [""]
index => systemosmetricsindex
stdout{codec => rubydebug }

Can you please tell me what is the error ?

(Magnus B├Ąck) #2

host => ""

What address is this?

(Shaswata Bisi) #3

This is the localhost ip address

(Steffen Siering) #4

Please format logs and configuration files using the </> button. This helps in reading/understanding your configuration.

Start with a very minimal logstash configuration sending to stdout only. No Elasticsearch and no filters...

Also have a look at Filebeat/Logstash logs! Without logs I can't tell any problems.

Also share your filebeat configuration.

Why do you bind logstash to one single device? Is filebeat on remote host or localhost as well?

(Shaswata Bisi) #5

I started minimal logstash configuration and with each working step, i kept on modifying the config file and then it finally worked. thanks a lot

(system) #6

This topic was automatically closed after 21 days. New replies are no longer allowed.