I’m making progress slowly but seem to have issues in my understanding of setting up filebeat. Graylog is up and running, I’ve created a collector an input/output, on a separate machine I have installed sidecar and I’m trying to configure filebeat. As of now it cannot find the generated filebeat.yml - I suspect because of some mismatch it isn’t getting generated maybe or I’m missing a step?
My collector-sidecar.yml is as follows:
server_url: http://xxx.xx.xxx.xx:9000/api
update_interval: 10
tls_skip_verify: false
send_status: true
list_log_files:
node_id: graylog-collector-sidecar
collector_id: file:C:\Program Files\graylog\collector-sidecar\collector-id
cache_path: C:\Program Files\graylog\collector-sidecar\cache
log_path: C:\Program Files\graylog\collector-sidecar\logs
log_rotation_time: 86400
log_max_age: 604800
tags: [mylogs]
backends:
- name: filebeat
enabled: true
binary_path: C:\Program Files\graylog\collector-sidecar\filebeat.exe
configuration_path: C:\Program Files\graylog\collector-sidecar\generated\filebeat.yml
Does collector-id have to match the name of the collector?
How critical is it that the tags match for creation of the filebeat.yml? I didn’t add tags initially and put them in afterwards.
I suppose step one is why I don’t get a generated\filebeat.yml created?
Any pointers would be much appreciated.
Chris,