Using both Filebeat and Winlogbeat

Elastic Stack Beats
1

Hello all, I'm using both Filebeat and Winlogbeat to send events to Logstash which then forwards them to Elasticsearch nodes, however whilst my Winlogbeat events are being indexed in Elasticsearch I cannot find anything for Filebeat

Relevant Filebeat config:

output.logstash:
  # The Logstash hosts
  hosts: ["192.168.56.227:5045"]

Relevant Logstash config:

input {
  beats {
    client_inactivity_timeout => 1200
    port => 5044
    type => wineventlog
  }
  beats {
    client_inactivity_timeout => 1200
    port => 5045
    type => filebeat

..........................................................................................

output {
  if [type] == "wineventlog" {
   elasticsearch {
     hosts => ["192.168.56.226:9200", "192.168.52.251:9200", "192.168.52.252:9200"]
     manage_template => false
     index => "%{[@metadata][beat]}-%{+YYYY.MM}"
     document_type => "%{[@metadata][type]}"
   }
  }

if [type] == "filebeat" {
   elasticsearch {
     hosts => ["192.168.56.226:9200", "192.168.52.251:9200", "192.168.52.252:9200"]
     manage_template => false
     index => "%{[@metadata][beat]}-%{+YYYY.MM}"
     document_type => "%{[@metadata][type]}"
   }
  }

Running netstat on the Logstash box shows the filebeat client IP connecting on port 5045, can anyone explain why I'm not seeing a filebeat- index in Elasticsearch?

Thanks for any help.

2

Can you share filebeat logs?

You apply some kind of filtering chocking on filebeat input?

Btw. you don't extra ports to distinguish between filebeat and winlogbeat (especially on outputs). You can use [@metadata][beat] for filtering. This simplifies you configuration to:

input {
  beats {
    client_inactivity_timeout => 1200
    port => 5044
  }
}

output {
  elasticsearch {
     hosts => ["192.168.56.226:9200", "192.168.52.251:9200", "192.168.52.252:9200"]
     manage_template => false
     index => "%{[@metadata][beat]}-%{+YYYY.MM}"
     document_type => "%{[@metadata][type]}"
   }
}
3

Thanks for you help Steffen, I changed the Logstash config as you suggested so there was just one beats input on port 5044; I then stopped the filebeat service on the client, deleted the registry file and log file then restarted the service - I can can now see a filebeat- index with the expected data in it.

Thanks once again.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.