Unable to start filebeat.error missing fileld

Elastic Stack Beats
1

Below is my filebeat.yml file , I am unable to start service getting error

filebeat.prospectors:
- input_type: log
** paths:**
** - /opt/apache-tomcat-7.0.82/logs/*.log**

document_type: apache-access
fields_under_root: true

output.logstash:
** hosts: '${host}'**

host is environment variable i did export host="10.2.3.1:5044"

Apr 10 06:59:35 node1 filebeat[401]: Exiting: error initializing publisher: missing field accessing 'output.logstash.hosts' (source:'/etc/filebeat/filebeat.yml')
Apr 10 06:59:35 node1 systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Apr 10 06:59:35 node1 systemd[1]: Unit filebeat.service entered failed state.
Apr 10 06:59:35 node1 systemd[1]: filebeat.service failed.
Apr 10 06:59:35 node1 systemd[1]: filebeat.service holdoff time over, scheduling restart.
Apr 10 06:59:35 node1 systemd[1]: start request repeated too quickly for filebeat.service
Apr 10 06:59:35 node1 systemd[1]: Failed to start filebeat.
Apr 10 06:59:35 node1 systemd[1]: Unit filebeat.service entered failed state.
Apr 10 06:59:35 node1 systemd[1]: filebeat.service failed.``

2

Hi,

It looks like there is something missing in your "output" section or "$" is not supporting .

Please try below format for output section and restart the service.

#----------------------------- Logstash output --------------------------------
output.logstash:
hosts: ["localhost:5044"]

Thanks,
Harsh Bajaj

3

I configured ENV variable. I should use that
if i type echo $host in terminal i get result 10.2.3.4:5044

4

Hi,

i agree and understand your concern but i've tried the same with log files where i've set ENV variable and it was not working there also so i used proper path instead of ENV variable and that was working properly.

try to use without ENV variable once.

Thanks,
Harsh Bajaj

5

Hi harsh Thank for suggestion, but I should use env variable that is my requirement , because i can't define logstash host in every docker image , when i run docker image then i pass env variables

7

Please format logs, configs and terminal input/output using the </>-Button or markdown code fences. This forum uses Markdown to format posts. Without proper formatting, it can be very hard to read your posts. Proper formatting helps us to help you.

Config files using YAML are sensitive to formatting and indentation. Without proper formatting it is difficult to spot any errors in your configs.

Environment variables should work, given the variable is present and the starting service correctly passes the environment variable to the child process. How exactly do you start filebeat?

The hosts setting must be an array.

You can enforce a custom error message via:

output.logstash:
  hosts: [${host:?host environment variable is not set}]
8

I start filebeat as systemctl start filebeat

9

That's the issue. Systemd does not pass environment variables.

As you mention systemd + docker I guess you are running on CoreOS? If so, check out CoreOS Environment variable docs.

10

No i am using centos:7 with all privileged option, systemctl also working fine, permanent env variable is setup

11

Where did you define the environment variable?

Have you updated the shipped systemd init files to pick up the environment variables?

The RPMs also install an SystemV script for some older systems. Make sure you delete/disable this file, so systemd does not pick up the wrong file by accident.

12

I am using root user and i defined in .bashrc file

13

Hi Ashok,

I'm also working on cent OS and checked the same on machine and found below solutions for the same.

Solution 1:
Systemctl doesn't have access the ENV file this is the reason not picking the configuration from system environment for this you can start the filebeat manually instead for "Systemctl" like below.

./filebeat -c /etc/filebeat/filebeat.yml &
it will pick the system ENV configuration and filebeat works smoothly.

Solution 2:
Go to the system filebeat service and edit
vi /usr/lib/systemd/system/filebeat.service and add Environment varaiable like below.

[Service]
Environment=host=X.X.X.X:5044

and reload the daemon and start your filebeat service.

Solution 3:
Create a text file and write all variables with values like below and save the file.

Textfile

host=x.x.x.x:5044
VAR2=value2
VAR3=value3

and edit the system filebeat service and give the path of your text file as below:

[Service]
EnvironmentFile=/etc/yourtextfile

and reload the daemon and start your filebeat service.

Thanks,
Harsh Bajaj

1 Like
14

Thanks Harsh, it worked for me

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.