Hi Chris, Can you post Filebeat logs as well please.
On Wednesday, September 28, 2016 at 3:06:48 PM UTC+3, Jochen Schalanda wrote: > > Hi Chris, > > which version of filebeat are you using? Has any new content been > added/appended to the log files you're monitoring after you've started > filebeat? > > Also take note that you can use the Graylog Collector Sidecar to manage > filebeat instances on your machines: > http://docs.graylog.org/en/2.1/pages/collector_sidecar.html > > Cheers, > Jochen > > On Wednesday, 28 September 2016 00:44:16 UTC+2, Chris wrote: >> >> Hi Jochen, >> >> I set up a filebeat forwarder on the Graylog server just to test >> localhost forwarding with the following configurations but even though >> Graylogs inputs page shows an active connection no data is being ingested: >> >> >> - bind_address: >> 0.0.0.0 >> - override_source: >> admin >> - port: >> 5044 >> - recv_buffer_size: >> 1048576 >> - tcp_keepalive: >> false >> - tls_cert_file: >> *<empty>* >> - tls_client_auth: >> disabled >> - tls_client_auth_cert_file: >> *<empty>* >> - tls_enable: >> false >> - tls_key_file: >> *<empty>* >> - tls_key_password: >> ******** >> >> >> >> Filebeat (/etc/filebeat/filebeat.yml): >> >> filebeat: >> prospectors: >> - >> paths: >> - /var/log/auth.log >> - /var/log/syslog >> >> input_type: log >> >> document_type: syslog >> >> registry_file: /var/lib/filebeat/registry >> >> output: >> logstash: >> hosts: ["127.0.0.1:5044"] >> >> bulk_max_size: 1024 >> >> logging: >> files: >> rotateeverybytes: 10485760 # = 10MB >> >> I took out the TLS configuration just to rule that out as a problem and >> the filebeat.yml is pretty basic. >> >> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/4eb81782-49c0-4598-8aa2-22ebe81645b9%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
