Questions tagged [filebeat]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

How to filter in kibana on input fields set in filebeat?

I've got filebeat setup sending logs to kibana. I have the apache module enabled which is sending the httpd error and access logs to kibana. I can filter on these by looking at the event.dataset field ...
0
votes
0answers
12 views

filebeat feed is not received in kibana

I have migrated jira app from serverA to serverB. I have installed same version of filebeat on serverB as it was on serverA, configured the "filebeat.yml" just like it was on serverA, open the port in ...
0
votes
1answer
19 views

Grok filter is not working properly

I have Filebeat-7.1 installed in a Debian server, this Filebeat send data from files in this Debian server to server with Logstash 7.6 , here are the files config Filebeat.yml: #=====================...
0
votes
1answer
211 views

Filebeat kafka input with SASL?

I'm trying to get filebeat to consume messages from kafka using the kafka input. I'm unable to authenticate with SASL for some reason and I'm not sure why that is. The documentation for both Kafka and ...
0
votes
1answer
121 views

Integrating nginx logs and elasticsearch app-search

I'm trying to setup a self-managed docker appsearch instance, together with kibana and elasticsearch, queried by a uvicorn python app, proxied by a nginx webserver My current issue is that the ...
2
votes
0answers
35 views

Error while enrolling: empty access_token

I have successfully installed a full ELK Docker stack including Filebeat. When I want to enroll a Filebeat instance, I get the following error: Error while enrolling: empty access_token According to ...
0
votes
0answers
18 views

logstash not proccessing filebeat data

I have configured elk stack on a aws server and also configured filebeat on two different aws server with same config. Telnet from both filebeat server to elk server on port 5044 working fine but ...
0
votes
0answers
35 views

Filebeat custom log files / how to disable default module field mappings

I'm using filebeat to read log files that are not supported out of the box, for elasticsearch indexing. The thing is that I get 1000+ field mappings that appear to be coming from default filebeat ...
0
votes
0answers
120 views

How do i send all logs from docker swarm to Elastic?

I have number of Linux server that have docker installed on them, all of the server are in a docker swarm, on each server i have a custom application. I also have ELK setup in AWS. I want to collect ...
0
votes
0answers
440 views

Provided Grok expressions do not match field value

edit: read below for update to initial question I'm getting Provided Grok expressions do not match field value even though _simulate works with exact same string. Error message: "message": "172.18....
2
votes
0answers
2k views

Parsing JSON event in Logstash

I have log in following format, it is a plain json with nested fields. { "level": "info", "message": { "req": { "headers": { "host": "localhost:8080", ...
0
votes
1answer
192 views

Mapping fields from a beats log message in graylog

this is a slightly rephrased version of: Whos is eating my fields? (or: how do I get more of the custom fields from my beats message into graylog) i am using filebeat to collect logs from a bunch ...
0
votes
1answer
278 views

Can't find docker log files for Filebeat

I'm trying to aggregate logs from my Kubernetes cluster into Elasticsearch server. To do that, I've deployed Filebeat on the cluster, but I think it doesn't have a chance to work since in the /var/lib/...
1
vote
1answer
7k views

Filebeat can't connect to logstash on another server

Filebeat (11.11.11.11) can't connect to logstash (22.22.22.22) on another server (connection reset by peer). But filebeat services from other servers can do it. Also I can connect from this server(11....
2
votes
0answers
550 views

filebeat makes a lot of I/O

We have filebeat on few servers that is writeing to elasticsearch. We can see that it is doing a lot of writes: PID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 353 be/3 ...
3
votes
1answer
2k views

Why is this exclude_lines in filebeat excluding all logs?

I'm using ELK Stack, and I've got it working pretty well for most of my servers. The exception is that I have a gitlab server that has a ping to/from a gitlab-ci server that happens in the gitlab-...
2
votes
1answer
170 views

ELK logstash and core grok patterns

I'm evaluating the ELK stack with filebeat & logstash across a diverse range of applications/ servers. I understand the power of customising my own grok patterns for each application/log, but to ...
1
vote
1answer
4k views

cannot validate certificate - doesn't contain any IP SAN

I am currently in the process of installing ELK ( ElastricSearch, LogStash & Kibana) stack. My ELK server IP address is 172.29.225.32. Elastic Search config is :: # -----------------------------...
2
votes
3answers
19k views

How to see if filebeat data is being sent to logstash

When I open up Kibana interface, I get an error to configure index when logstash-* is entered as a query: kibana error: please specify a default index pattern How can I see if filebeat is sending ...
1
vote
0answers
255 views

Why does syslog create a user.log instead using syslog.log?

I have experienced something a bit weird for me. I have filebeat monitoring my rsyslog (syslog.log) file and sending it to my logstash. I have noticed that after restarting filebeat where syslog is ...
3
votes
2answers
1k views

Different extractors for the same Graylog input?

I'm using Graylog's sidecar functionality with Filebeat to pickup a number of different log files off my server, including Syslog, Nginx and Java App. All of these flow into the same Graylog input for ...
0
votes
2answers
2k views

Kibana @timestamp mapping & filter

I'm using following system/package: $ cat /etc/redhat-release CentOS Linux release 7.2.1511 (Core) $ rpm -q filebeat filebeat-1.3.0-1.x86_64 $ with /etc/filebeat/filebeat.yml: $ cat /etc/...