Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [filebeat]

The tag has no usage guidance.

2
votes
0answers
220 views

Parsing JSON event in Logstash

I have log in following format, it is a plain json with nested fields. { "level": "info", "message": { "req": { "headers": { "host": "localhost:8080", ...
0
votes
0answers
83 views

Getting Apache2 combined logs into the Elastic Stack and using dashboards

I am looking into the ELK stack, and I mostly got it running. My goal would be to get the Apache2 dashboards running in Kibana, but I am unable to. This is how far I got: **On the Apache side:* I am ...
0
votes
0answers
39 views

Filebeat is not sending data to Logstash

I’m trying to send alerts from Snort IDS to Elasticsearch, therefore I'm using 3 technologies: Elasticsearch- https://pastebin.com/uCNMaZFJ Logstash-https://pastebin.com/zgnbbw9K Filebeat- https://...
0
votes
0answers
63 views

kubernetes daemonset fails on 1 of 5 nodes

Im installing filebeat as a daemonset into a k8 cluster. The 5 nodes are identical (in every way that I can determine) but the filebeat pod won't start on one node (runs fine on 4/5). Error message: ...
0
votes
0answers
88 views

Mapping fields from a beats log message in graylog

this is a slightly rephrased version of: Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog) i am using filebeat to collect logs from a bunch ...
0
votes
0answers
103 views

Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog)

I am collecting logs from docker compute nodes and sending them to the beats plugin of graylog. i am using filebeat 6.4.3 with a config like this: filebeat.autodiscover: providers: - type: ...
0
votes
0answers
129 views

Multiple multiline parsers in Kubernetes Filebeat config

I'm using Filebeat to ship logs to Kubernetes. How can I configure multiline collation differently based on different conditions? E.g., use a Java log regex for my Java containers, and a PHP regex for ...
0
votes
1answer
165 views

Can't find docker log files for Filebeat

I'm trying to aggregate logs from my Kubernetes cluster into Elasticsearch server. To do that, I've deployed Filebeat on the cluster, but I think it doesn't have a chance to work since in the /var/lib/...
0
votes
0answers
27 views

Can filebeat inject metadata from a separate file?

I have a kubernetes cluster whose logs are being scraped by filebeat. Each filebeat container sees a number of logfiles of the format /var/lib/docker/containers/[CONTAINER_ID]/[CONTAINER_ID]-json.log ...
1
vote
1answer
3k views

Filebeat can't connect to logstash on another server

Filebeat (11.11.11.11) can't connect to logstash (22.22.22.22) on another server (connection reset by peer). But filebeat services from other servers can do it. Also I can connect from this server(11....
2
votes
0answers
291 views

filebeat makes a lot of I/O

We have filebeat on few servers that is writeing to elasticsearch. We can see that it is doing a lot of writes: PID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 353 be/3 ...
3
votes
1answer
807 views

Why is this exclude_lines in filebeat excluding all logs?

I'm using ELK Stack, and I've got it working pretty well for most of my servers. The exception is that I have a gitlab server that has a ping to/from a gitlab-ci server that happens in the gitlab-...
2
votes
1answer
142 views

ELK logstash and core grok patterns

I'm evaluating the ELK stack with filebeat & logstash across a diverse range of applications/ servers. I understand the power of customising my own grok patterns for each application/log, but to ...
1
vote
1answer
2k views

cannot validate certificate - doesn't contain any IP SAN

I am currently in the process of installing ELK ( ElastricSearch, LogStash & Kibana) stack. My ELK server IP address is 172.29.225.32. Elastic Search config is :: # -----------------------------...
1
vote
2answers
9k views

How to see if filebeat data is being sent to logstash

When I open up Kibana interface, I get an error to configure index when logstash-* is entered as a query: kibana error: please specify a default index pattern How can I see if filebeat is sending ...
1
vote
0answers
183 views

Why does syslog create a user.log instead using syslog.log?

I have experienced something a bit weird for me. I have filebeat monitoring my rsyslog (syslog.log) file and sending it to my logstash. I have noticed that after restarting filebeat where syslog is ...
3
votes
2answers
1k views

Different extractors for the same Graylog input?

I'm using Graylog's sidecar functionality with Filebeat to pickup a number of different log files off my server, including Syslog, Nginx and Java App. All of these flow into the same Graylog input for ...
0
votes
1answer
1k views

Kibana @timestamp mapping & filter

I'm using following system/package: $ cat /etc/redhat-release CentOS Linux release 7.2.1511 (Core) $ rpm -q filebeat filebeat-1.3.0-1.x86_64 $ with /etc/filebeat/filebeat.yml: $ cat /etc/...