CODEWITHSUNDEEP
elasticsearchfilebeat
Luv33preet
Luv33preet

Reputation: 1867

Using filebeat with elasticsearch

I am not getting that how to run this filebeat in order to send output to elasticsearch.

This is from the filebeat.yml file,

- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/nginx/access.log

output.elasticsearch:
  # Array of hosts to connect to.
    hosts: ["localhost:9200"]
    index: 'filebeat_nginx'

elasticsearch is up and running.

Now, how to run filebeat to send the log info to elasticsearch.

If I go to bin directory of filebeat, and run this command,

luvpreet@DHARI-Inspiron-3542:/usr/share/filebeat/bin$ sudo ./filebeat -configtest -e

then it shows ,

filebeat2017/04/19 06:54:22.450440 beat.go:339: CRIT Exiting: error loading config file: stat filebeat.yml: no such file or directory
Exiting: error loading config file: stat filebeat.yml: no such file or directory

The filebeat.yml file is in the /etc/filebeat folder. How to run it ? Please clarify the process to run this with elasticsearch.

Upvotes: 4

Views: 5990

Answers (3)

Bipin Kumar
Bipin Kumar

Reputation: 21

1.If you have installed the rpm package, you will have /etc/filebeat/filebeat.yml file. Edit the file to send the output to Elasticsearch and start it using command "/etc/init.d/filebeat start" 2. If you have downloaded binary and installed it, you can use the command "Downloads/filebeat-5.4.0-darwin-x86_64/filebeat -e -c location_to_your_filebeat.yml"

Upvotes: 0

Paul Back
Paul Back

Reputation: 1319

A typical filebeat command looks like this:

/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml \
-path.home /usr/share/filebeat -path.config /etc/filebeat \
-path.data /var/lib/filebeat -path.logs /var/log/filebeat

-c indicates your config file, as noted in the comments above. path.home is your scripts. path.config contains config files. path.data is where state is maintained. path.logs is where the filebeat process will log.

Upvotes: 3

Halil
Halil

Reputation: 109

If you have made the necessary arrangements in /etc/filebeat/filebeat.yml file, you can use this command "service filebeat start". After the service is started you can control service this command "service filebeat status". If there is an error, you can see errors.

Upvotes: 0

Related Questions