Hi Chris, which version of filebeat are you using? Has any new content been added/appended to the log files you're monitoring after you've started filebeat?
Also take note that you can use the Graylog Collector Sidecar to manage filebeat instances on your machines: http://docs.graylog.org/en/2.1/pages/collector_sidecar.html Cheers, Jochen On Wednesday, 28 September 2016 00:44:16 UTC+2, Chris wrote: > > Hi Jochen, > > I set up a filebeat forwarder on the Graylog server just to test localhost > forwarding with the following configurations but even though Graylogs > inputs page shows an active connection no data is being ingested: > > > - bind_address: > 0.0.0.0 > - override_source: > admin > - port: > 5044 > - recv_buffer_size: > 1048576 > - tcp_keepalive: > false > - tls_cert_file: > *<empty>* > - tls_client_auth: > disabled > - tls_client_auth_cert_file: > *<empty>* > - tls_enable: > false > - tls_key_file: > *<empty>* > - tls_key_password: > ******** > > > > Filebeat (/etc/filebeat/filebeat.yml): > > filebeat: > prospectors: > - > paths: > - /var/log/auth.log > - /var/log/syslog > > input_type: log > > document_type: syslog > > registry_file: /var/lib/filebeat/registry > > output: > logstash: > hosts: ["127.0.0.1:5044"] > > bulk_max_size: 1024 > > logging: > files: > rotateeverybytes: 10485760 # = 10MB > > I took out the TLS configuration just to rule that out as a problem and > the filebeat.yml is pretty basic. > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/a206eda3-e04e-4350-a624-e0c8d9df7bef%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
