Filebeat New Install on Debian Stretch 9

Graylog Central (peer support)
1

I am having trouble getting filebeat working on Debian 9 stretch.

There error I get is:

– Unit filebeat.service has finished starting up.

– The start-up result is done.
Aug 27 19:05:46 nis-1 filebeat[10863]: Exiting: Error in initing input: type mismatch accessing ‘filebeat.inputs.0.protocol’ (source:’/etc/filebeat/filebeat.yml’)
Aug 27 19:05:46 nis-1 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
Aug 27 19:05:46 nis-1 systemd[1]: filebeat.service: Unit entered failed state.

These are my inputs:

filebeat.inputs:

Each - is an input. Most options can be set at the input level, so

you can use different inputs for various configurations.

Below are the input specific configurations.

  • type: syslog

    Change to true to enable this input configuration.

    enabled: true
    protocol.udp:
    host: “localhost:9000”

    Paths that should be crawled and fetched. Glob based paths.

    paths:

    • /var/log/mail.log
    • /var/log/mail.info
    • /var/log/unifi-backup-cron.log
    • /var/log/pfsense-dhcpd-101_336.log
    • /var/log/pfsense-to_macserver-101_336.log
    • /var/log/user.log
    • /var/log/pfsense-101.log
    • /var/log/pfsense-openvpn-101_336.log
    • /var/log/pfsense-kernel-101_336.log
    • /var/log/macserver.log
    • /var/log/kern.log
    • /var/log/debug
    • /var/log/pfsense-filterlog-101_336.log
    • /var/log/messages
    • /var/log/btmp
    • /var/log/auth.log
    • /var/log/wtmp
    • /var/log/lastlog
    • /var/log/named
    • /var/log/syslog
    • /var/log/rsyslog_debugfmt
    • /var/log/pfsense-charon-101_336.log
    • /var/log/daemon.log

Any ideas?

This is my first crack at this so be easy on me :slight_smile:

2

First it would be nice to have your post proper formated: https://community.graylog.org/faq#format-markdown
Second, this is the Graylog community and not the elastic community.
Third, you did not include any information that might someone need to give you help. That would include the filebeat version, how you installed it, what your goal is.

3

I thought my post was fairly self explanatory I want to send logs using filebeat, I am confused by your ask and what you need clarified?

Filebeat I thought was not specific to any receiving technology.

I was looking for a filebeat forum and this one had information regarding similar issues that I was having.

If there is a better forum to post filebeat queries to, guidance is appreciated.

4

Filebeat is maintained by elastic and the community can be found over at https://discuss.elastic.co/

Your question and problem is not clear, and you did not include a version. In addition the formatting you choose did not help to make your posting readable.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.