Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows Filebeat default configuration is missing #350

Closed
BitDesert opened this issue Mar 6, 2019 · 3 comments · Fixed by Graylog2/graylog2-server#6287

Comments

@BitDesert
Copy link

commented Mar 6, 2019

Problem description

After the upgrade to Graylog 3.0.0 and Collector 1.0.0 the Filebeat log collector configuration is missing in the default configuration. The filebeat.exe is located at "C:\Program Files\Graylog\collector-sidecar\filebeat.exe" but a default configuration is missing.

Steps to reproduce the problem

  1. Update Graylog to 3.0.0
  2. Check the Log collectors at /system/sidecars/configuration , only filebeat (Linux), nxlog (Linux), nxlog (Windows) and winlogbeat (Windows) are available.

Environment

  • Sidecar Version: 1.0.0
  • Graylog Version: 3.0.0
  • Operating System: Ubuntu 16.04
  • Elasticsearch Version: 6.6.1
  • MongoDB Version: 2.6.10

@mpfz0r mpfz0r changed the title Windows Filebeat Log Collector missing? Windows Filebeat default configuration is missing Mar 7, 2019

@mpfz0r

This comment has been minimized.

Copy link
Member

commented Mar 7, 2019

That's correct,
is there a brave soul that would provide us a meaningful default configuration we could include?

In the meantime, looking at the winlogbeat default and the linux filebeat default configuration
should get you started.

@BitDesert

This comment has been minimized.

Copy link
Author

commented Mar 8, 2019

I've build the following config based on the other existing ones:

# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

filebeat:
  prospectors:
  - encoding: plain
    ignore_older: 0
    paths:
    - C:\logs\log.log
    scan_frequency: 10s
    tail_files: true
    type: log
output:
  logstash:
    hosts:
    - 192.168.1.1:5044
path:
  data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
  logs: C:\Program Files\Graylog\sidecar\logs
tags:
- windows

@deeshe deeshe added the triaged label Mar 12, 2019

@mpfz0r mpfz0r added this to the 3.1.0 milestone Apr 8, 2019

@jalogisch

This comment has been minimized.

Copy link
Member

commented Jun 4, 2019

For Filebeat 7.x the above would be:

# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

filebeat:
	inputs:
		type: log
		enable: true
		paths:
		- C:\logs\log.log

output:
	logstash:
		hosts:
		- 192.168.1.1:5044

path:
	data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
	logs: C:\Program Files\Graylog\sidecar\logs

@bernd bernd modified the milestones: 3.1.0-legacy, 3.1.0 Jul 25, 2019

mpfz0r added a commit to Graylog2/graylog2-server that referenced this issue Aug 13, 2019
mariussturm added a commit to Graylog2/graylog2-server that referenced this issue Aug 14, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.