Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [filebeat]

26 questions
4
votes
4 answers

How to see if filebeat data is being sent to logstash

When I open up Kibana interface, I get an error to configure index when logstash-* is entered as a query: kibana error: please specify a default index pattern How can I see if filebeat is sending logs to logstash? I followed the filebeat and ELK…
Celi Manu
  • 161
  • 1
  • 1
  • 5
3
votes
1 answer

Why is this exclude_lines in filebeat excluding all logs?

I'm using ELK Stack, and I've got it working pretty well for most of my servers. The exception is that I have a gitlab server that has a ping to/from a gitlab-ci server that happens in the gitlab-access log. This happens every second, and I'd like…
trueCamelType
  • 1,086
  • 5
  • 20
  • 42
3
votes
2 answers

Different extractors for the same Graylog input?

I'm using Graylog's sidecar functionality with Filebeat to pickup a number of different log files off my server, including Syslog, Nginx and Java App. All of these flow into the same Graylog input for Beats (I tried to supply multiple inputs,…
Jon
  • 632
  • 6
  • 13
2
votes
0 answers

Error while enrolling: empty access_token

I have successfully installed a full ELK Docker stack including Filebeat. When I want to enroll a Filebeat instance, I get the following error: Error while enrolling: empty access_token According to the source, the error can be anything, if the…
Daniel W.
  • 1,609
  • 4
  • 26
  • 48
2
votes
0 answers

Parsing JSON event in Logstash

I have log in following format, it is a plain json with nested fields. { "level": "info", "message": { "req": { "headers": { "host": "localhost:8080", "connection": "keep-alive", …
vkpro
  • 21
  • 1
  • 2
2
votes
1 answer

Filebeat can't connect to logstash on another server

Filebeat (11.11.11.11) can't connect to logstash (22.22.22.22) on another server (connection reset by peer). But filebeat services from other servers can do it. Also I can connect from this server(11.11.11.11) using telnet to this port (telnet…
Dmitry
  • 179
  • 1
  • 2
  • 8
2
votes
0 answers

filebeat makes a lot of I/O

We have filebeat on few servers that is writeing to elasticsearch. We can see that it is doing a lot of writes: PID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 353 be/3 root 0.00 B/s 4.52 K/s 0.00 % 0.55 %…
usterk
  • 121
  • 1
  • 5
2
votes
1 answer

ELK logstash and core grok patterns

I'm evaluating the ELK stack with filebeat & logstash across a diverse range of applications/ servers. I understand the power of customising my own grok patterns for each application/log, but to get running initially it seems very inefficient to…
Dan Poltawski
  • 141
  • 1
  • 3
2
votes
2 answers

systemd file not pickuping environment values

Systemd file for filebeat doesn't pickup env variables and throw as below ExecStart=/usr/share/filebeat/bin/filebeat -environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=2) Below is my systemd for filebeat…
Sudharsan Punniyakotti
  • 21
  • 2
1
vote
1 answer

cannot validate certificate - doesn't contain any IP SAN

I am currently in the process of installing ELK ( ElastricSearch, LogStash & Kibana) stack. My ELK server IP address is 172.29.225.32. Elastic Search config is :: # ---------------------------------- Network ----------------------------------- # #…
Jason Stanley
  • 185
  • 1
  • 1
  • 11
1
vote
0 answers

Why does syslog create a user.log instead using syslog.log?

I have experienced something a bit weird for me. I have filebeat monitoring my rsyslog (syslog.log) file and sending it to my logstash. I have noticed that after restarting filebeat where syslog is running, syslogs creates a new file user.log under…
ndarkness
  • 193
  • 1
  • 7
1
vote
2 answers

Kibana @timestamp mapping & filter

I'm using following system/package: $ cat /etc/redhat-release CentOS Linux release 7.2.1511 (Core) $ rpm -q filebeat filebeat-1.3.0-1.x86_64 $ with /etc/filebeat/filebeat.yml: $ cat /etc/filebeat/filebeat.yml filebeat: prospectors: - …
alexus
  • 13,112
  • 32
  • 117
  • 174
1
vote
0 answers

Certificate only works from client side, how do I debug something like this? (graylog/filebeat/JVM keystore)

I created 2 key-certificate pairs with the exact same method. However, while trying to setup TLS on my graylog server to a remote filebeat node, it does not successfully connect when trying to connect with a regular certificate validating the…
Damian Games
  • 23
  • 5
1
vote
0 answers

Suricata / Filebeat / ELK - iptables tee - Create virtual hosts

I have an IDS setup as follow: Hardware / interfaces WAN <----(brwan)> ROUTER / AP <(br0)----> LAN \ -----(eth1)> | \ | IDS…
Gabriel ROUSSEAU
  • 11
  • 1
0
votes
1 answer

Integrating nginx logs and elasticsearch app-search

I'm trying to setup a self-managed docker appsearch instance, together with kibana and elasticsearch, queried by a uvicorn python app, proxied by a nginx webserver My current issue is that the appsearch logs show the python default user-agent and IP…
Niloct
  • 121
  • 6
1
2