Can Graylog Sidecar windows filebeat cause iis service down or Resources consumption?

Graylog Central (peer support)
,
1

I have installed Grayloy sidecar on windows server to get log which output from .Netfromework application(running in IIS). to send log to graylog server i used windows filebeat.
here is my configuration:

Needed for Graylog

fields_under_root: true
fields.collector_node_id: {sidecar.nodeName} fields.gl2_source_collector: {sidecar.nodeId}

output.logstash:
hosts: [“graylog-server-ip:5044”]
path:
data: C:\Program Files\Graylog\sidecar\cache\filebeat\data
logs: C:\Program Files\Graylog\sidecar\logs
tags:

  • windows
    filebeat.inputs:
  • type: log
    enabled: true
    paths:
    • C:\path-to\application-log\*.log

I have no idea why server down. I am not sure it cause by graylog sidecar or other reasons.
thanks

2

@phalla You can check Graylog server logs and sidecar.logs to know the cause of it. If possible share your suspicious errors logs here in case need further assitance.

3

@makarands
here are the logs i got from 2 file sidecar.log and filebeat from client server(windows server)
***Error from sidecar.log
level=error msg="[UpdateRegistration] Bad response from Graylog server: 502 Bad Gateway
*** Error from filebeat log
2020-07-15T09:08:31.705+0700 ERROR pipeline/output.go:100 Failed to connect to
backoff(async(tcp://graylog-server-ip:5044)
): dial tcp graylog-server-ip:5044: connectex: No connection could be made because the target machine
actively refused it.

Note: one thing i notice that the log files that output from .Netframework application is written new lines less than 1s

4

you should check your Graylog server why it is down … that will tell you (maybe) the server.log of Graylog.

5

@jan
Thank so much for your responses, i figure out the problem. it is because of sidecar service conflict with another service that try to achieve the log files.