1

Installed the sidecar collector and configured it with the filebeat backend. It's running successfully. Made an output and attached some inputs to it with general log files. No logs showing up on the dashboard yet. Here's my debug output, which gives me nothing useful:

sudo service collector-sidecar stop
graylog-collector-sidecar -c /etc/graylog/collector-sidecar/collector_sidecar.yml
INFO[0000] Using collector-id: xxx
INFO[0000] Fetching configurations tagged by: [syslog linux] 
INFO[0000] Starting collector supervisor                
INFO[0000] [filebeat] Starting                          
INFO[0010] [filebeat] Configuration change detected, rewriting configuration file. 
INFO[0010] [filebeat] Stopping                          
INFO[0014] [filebeat] Starting

Should I also make a system -> input? How can I debug the fact that logs are not showing up? What am I missing here?

user638145
  • 57
  • 2
  • 9

1 Answers1

1

I'll give this a shot...

recently I had a similar Problem, which in the end was triggered by the fact, that i ran the graylog2 docker container without opening port 5044. That seems to be the one on which the sidecar delivers content, whereas it's heartbeat seems go on port 9000, which i had open, so graylog webinterface told me the collector was running OK.

As you configure an input in the collector configuration, you should not have to do so in the input section. when i look into my inputs section, the collector-configured input shows up as a local input.

After adjusting the Docker container to open up 5044 everything went allright.

This refers to graylog running on docker, I don't know if that's your environment, but it might help anyway ;-)

cheers, Arend

Arend Vogtländer
  • 28
  • 5