Sidecar 1.5 can't start the filebeat that it is shipped with

Graylog Central (peer support)
1

Hi,

I’m trying to use Sidecar 1.5 with filebeat on a Linux server.
The sidecar runs without problem and i can see it on the admin gui, but when i try to apply the default filebeat on Linux config it don’t start.

My config:

Needed for Graylog

fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

filebeat.inputs:

  • input_type: log
    paths:
    • /var/log/.log
      type: log
      output.logstash:
      hosts: ["      *.local:“]
      path:
      data: ${sidecar.spoolDir!”/var/lib/graylog-sidecar/collectors/filebeat"}/data
      logs: ${sidecar.spoolDir!“/var/lib/graylog-sidecar/collectors/filebeat”}/log

Error message: “Couldn’t start validation command: fork/exec /usr/share/filebeat/bin/filebeat: no such file or directory”

I have the filebeat binary installed with the sidecar: /usr/lib/graylog-sidecar/filebeat

In the documentation i only found this:
“Previously you needed to install collectors before being able to fully utilize the sidecar. Sidecar version 1.5 ships with the collectors shown below:”

So i shouldn’t need to install filebeat, the sidecar should start and it with the generated config (whitch is in the generated folder, i checked).

How can i configure the sidecar that it should use it’s own filebeat? Didn’t have any problem on Windows, but can’t make it work on Linux.

2

Ok, i could make it work by creating the /usr/share/filebeat/bin directory structure and copying the filebeat binary from /usr/lib/graylog-sidecar, but still think Sidecar should be able to find it’s own collectors.

1 Like
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.