Not able to view multiple logs with collector filebeat configuration

Graylog Central (peer support)
, , , ,
1

Hi ,
I have a nfs mount where I am collecting the logs from different machines and want to display output for each server logs ,
I am creating the collector configurations through different tags for each server log ,

Here is my collector and filebeat configurations

server_url: http://10.175.184.251:9000/api/
update_interval: 10
tls_skip_verify: false
send_status: true
list_log_files:
collector_id: file:/etc/graylog/collector-sidecar/collector-id
cache_path: /var/cache/graylog/collector-sidecar
log_path: /var/log/graylog/collector-sidecar
log_rotation_time: 86400
log_max_age: 604800
tags:
- linux
- apache
- webserver04
backends:
- name: nxlog
enabled: false
binary_path: /usr/bin/nxlog
configuration_path: /etc/graylog/collector-sidecar/generated/nxlog.conf
- name: filebeat
enabled: true
binary_path: /usr/bin/filebeat
configuration_path: /etc/graylog/collector-sidecar/generated/filebeat.yml

/etc/graylog/collector-sidecar/generated/filebeat.yml:
filebeat:
prospectors:

  • encoding: plain
    exclude_files: []
    fields:
    collector_node_id: prd-log01.lb.nl
    gl2_source_collector: 785cb392-8649-4e08-9f8b-f93411552509
    type: log
    ignore_older: 0
    paths:
    • /var/log/*.log
      scan_frequency: 10s
      tail_files: true
      type: log
  • encoding: plain
    exclude_files: []
    fields:
    collector_node_id: prd-log01.lb.nl
    gl2_source_collector: 785cb392-8649-4e08-9f8b-f93411552509
    type: log
    ignore_older: 0
    paths:
    • /lognfs/webserver04/log.
      scan_frequency: 10s
      tail_files: true
      type: log
      output:
      logstash:
      hosts:
    • 10.175.184.251:5044
      path:
      data: /var/cache/graylog/collector-sidecar/filebeat/data
      logs: /var/log/graylog/collector-sidecar
      tags:
  • linux
  • apache
  • webserver04

However i am not able to view the output .

Can you please advise

2

if you have a beats input running on Graylog on Port 5044 you might have issues with the NFS Share.

having filebeats reading from NFS is known to be not stable.

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.