Question

因此，我已将filebeat配置为接受通过TCP的输入。这是filebeat.yml文件。

filebeat.inputs:
- type: tcp
  host: ["localhost:9000"]
  max_message_size: 20MiB

由于某些原因，filebeat不能在端口9000上启动TCP服务器。我已经使用wireshark对此进行了验证。 Wireshark在端口9000上什么也没显示。

这是在终端上运行的命令“ filebeat -e -d” *“”的输出

2019-08-14T09:12:40.745-0600    INFO    instance/beat.go:468    Home path: [/usr/local/Cellar/filebeat/6.2.4] Config path: [/usr/local/etc/filebeat] Data path: [/usr/local/var/lib/filebeat] Logs path: [/usr/local/var/log/filebeat]
2019-08-14T09:12:40.745-0600    DEBUG   [beat]  instance/beat.go:495    Beat metadata path: /usr/local/var/lib/filebeat/meta.json
2019-08-14T09:12:40.745-0600    INFO    instance/beat.go:475    Beat UUID: 764da0fd-ea93-4777-b1ea-63149be0d6b6
2019-08-14T09:12:40.745-0600    INFO    instance/beat.go:213    Setup Beat: filebeat; Version: 6.2.4
2019-08-14T09:12:40.745-0600    DEBUG   [beat]  instance/beat.go:230    Initializing output plugins
2019-08-14T09:12:40.745-0600    DEBUG   [processors]    processors/processor.go:49      Processors: 
2019-08-14T09:12:40.745-0600    INFO    pipeline/module.go:76   Beat name: Ad-MBP.domain
2019-08-14T09:12:40.745-0600    ERROR   fileset/modules.go:95   Not loading modules. Module directory not found: /usr/local/Cellar/filebeat/6.2.4/module
2019-08-14T09:12:40.745-0600    INFO    [monitoring]    log/log.go:97   Starting metrics logging every 30s
2019-08-14T09:12:40.745-0600    INFO    instance/beat.go:301    filebeat start running.
2019-08-14T09:12:40.745-0600    DEBUG   [registrar]     registrar/registrar.go:90       Registry file set to: /usr/local/var/lib/filebeat/registry
2019-08-14T09:12:40.746-0600    INFO    registrar/registrar.go:110      Loading registrar data from /usr/local/var/lib/filebeat/registry
2019-08-14T09:12:40.746-0600    INFO    registrar/registrar.go:121      States Loaded from registrar: 0
2019-08-14T09:12:40.746-0600    WARN    beater/filebeat.go:261  Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2019-08-14T09:12:40.746-0600    INFO    crawler/crawler.go:48   Loading Prospectors: 1
2019-08-14T09:12:40.746-0600    DEBUG   [registrar]     registrar/registrar.go:152      Starting Registrar
2019-08-14T09:12:40.746-0600    DEBUG   [cfgfile]       cfgfile/reload.go:95    Checking module configs from: /usr/local/etc/filebeat/modules.d/*.yml
2019-08-14T09:12:40.746-0600    DEBUG   [cfgfile]       cfgfile/reload.go:109   Number of module configs found: 0
2019-08-14T09:12:40.746-0600    INFO    crawler/crawler.go:82   Loading and starting Prospectors completed. Enabled prospectors: 0
2019-08-14T09:12:40.746-0600    INFO    cfgfile/reload.go:127   Config reloader started
2019-08-14T09:12:40.748-0600    DEBUG   [cfgfile]       cfgfile/reload.go:151   Scan for new config files
2019-08-14T09:12:40.748-0600    DEBUG   [cfgfile]       cfgfile/reload.go:170   Number of module configs found: 0
2019-08-14T09:12:40.748-0600    INFO    cfgfile/reload.go:219   Loading of config files completed.

我不确定我在做什么错。.

Answer 1

我相信filebeat输入只能从filebeat 6.3+（任何使用过的文件拍探矿器）中获得。

6.3 TCP输入文档，由于使用探矿器，因此6.2或更低版本不可用： https://www.elastic.co/guide/en/beats/filebeat/6.3/filebeat-input-tcp.html

您的日志显示您使用的文件格式为6.24，可以用6.3+尝试配置吗？

Filebeat无法启动TCP服务器（输入）

1 个答案: