Search code examples
logstashfilebeatelk

Filebeat registry data.json is empty


I am trying to setup filebeat, but it not harvesting logs at all from the given log file path.

After lot of research, I came to know that data.json in registry folder is empty which is why filebeat is unable to read logs from log file.

Can someone please suggest how to fix this?

Note :- there is no error in filebeat logs saying permission denied to write into data.json

filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/mahesh/Documents/refactor/nomi/unity/media/*.log

output.logstash:
  enabled: true
  hosts: ["localhost:5044"]

Solution

  • i also meet the trouble as you mentioned above, but i don't know reason. I'm using filebeat 7.8.0. my config is the following:

    filebeat.autodiscover:
      providers:
        - type: docker
          templates:
            - condition:
                contains:
                  docker.container.image: log:latest
              config:
                - type: log
                  paths:
                    - /var/lib/docker/containers/${data.docker.container.id}/*-json.log
    
    output.elasticsearch:
      enabled: true
      hosts: ["http://es01:9200"]
    
    setup.template.name: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
    setup.template.pattern: "filebeat-*"
    setup.ilm.enabled: false