Unable to parse log via filebeat

Hi Team,
My setup has been working perfectly fine for quite some time now, however, i am working on injecting new set of logs into logstash via filebeat which is not happening. I dont see any visible errors with filebeat logs.

2019-09-03T04:21:38.692-0700    INFO    registrar/registrar.go:134      Loading registrar data from /var/lib/filebeat/registry
2019-09-03T04:21:38.692-0700    INFO    registrar/registrar.go:141      States Loaded from registrar: 0
2019-09-03T04:21:38.692-0700    WARN    beater/filebeat.go:371  Filebeat is unable to load the Ingest Node pipelines for the configured modules because the E
lasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warn
ing.
2019-09-03T04:21:38.692-0700    INFO    crawler/crawler.go:72   Loading Inputs: 1
2019-09-03T04:21:38.693-0700    INFO    log/input.go:138        Configured paths: [/opt/bea/fttusext/fttusextlogs/projectIntl/profile-intl/profile_service-in
tl.log]
2019-09-03T04:21:38.693-0700    INFO    input/input.go:114      Starting input of type: log; ID: 17997996226164660362
2019-09-03T04:21:38.693-0700    INFO    crawler/crawler.go:106  Loading and starting Inputs completed. Enabled inputs: 1
2019-09-03T04:21:38.693-0700    INFO    cfgfile/reload.go:141   Config reloader started
2019-09-03T04:21:38.693-0700    INFO    cfgfile/reload.go:196   Loading of config files completed.
2019-09-03T04:22:08.630-0700    INFO    [monitoring]    log/log.go:141  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"s
ystem":{"ticks":30,"time":{"ms":38}},"total":{"ticks":40,"time":{"ms":56},"value":40},"user":{"ticks":10,"time":{"ms":18}}},"info":{"ephemeral_id":"0a855b32-
aed8-4065-bab9-62fbecf12716","uptime":{"ms":30025}},"memstats":{"gc_next":4194304,"memory_alloc":2319696,"memory_total":3900688,"rss":16019456}},"filebeat":{
"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0},"reloads":1},"output":{"type":"logstash"},"pipeline":{"clients":1,"even
ts":{"active":0}}},"registrar":{"states":{"current":0},"writes":{"success":1,"total":1}},"system":{"cpu":{"cores":8},"load":{"1":0.13,"15":0.2,"5":0.17,"norm
":{"1":0.0163,"15":0.025,"5":0.0213}}}}}}
2019-09-03T04:22:38.628-0700    INFO    [monitoring]    log/log.go:141  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"s
ystem":{"ticks":30,"time":{"ms":2}},"total":{"ticks":50,"time":{"ms":5},"value":50},"user":{"ticks":20,"time":{"ms":3}}},"info":{"ephemeral_id":"0a855b32-aed
8-4065-bab9-62fbecf12716","uptime":{"ms":60025}},"memstats":{"gc_next":4194304,"memory_alloc":2518768,"memory_total":4099760}},"filebeat":{"harvester":{"open
_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}},"sy
stem":{"load":{"1":0.08,"15":0.19,"5":0.15,"norm":{"1":0.01,"15":0.0238,"5":0.0188}}}}}}
2019-09-03T04:23:08.629-0700    INFO    [monitoring]    log/log.go:141  Non-zero metrics in the last 30s        {"monitoring": {"metrics": {"beat":{"cpu":{"s
ystem":{"ticks":40,"time":{"ms":4}},"total":{"ticks":60,"time":{"ms":5},"value":60},"user":{"ticks":20,"time":{"ms":1}}},"info":{"ephemeral_id":"0a855b32-aed
8-4065-bab9-62fbecf12716","uptime":{"ms":90025}},"memstats":{"gc_next":4194304,"memory_alloc":2700064,"memory_total":4281056}},"filebeat":{"harvester":{"open
_files":0,"running":0}},"libbeat":{"config":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":0}}},"registrar":{"states":{"current":0}},"sy
stem":{"load":{"1":0.05,"15":0.19,"5":0.14,"norm":{"1":0.0063,"15":0.0238,"5":0.0175}}}}}}

It looks like it's not finding anything to harvest.

If you restart filebeat with this config, do you still get "States Loaded from registrar: 0"?

What does

ls -al /opt/bea/fttusext/fttusextlogs/projectIntl/profile-intl/profile_service-intl.log

show? (This is your path to logs, I'm not sure it copied correctly in the post)

If the log path matches, are there current logs? Do you have ignore_older in filebeat?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.