Skip to content

FileBeat log configuration not working #2

@pranav-patil

Description

@pranav-patil

The LogStash service is unable to fetch the logs from FileBeat with the filebeat-ds.yaml config file. Currently the application logback directly sends all the logs to 5044 to logstash server. The application logback should be switched to standard ConsoleAppender, with a LogstashEncoder needed to encode logs in JSON. Filebeat should be configured to extract the application logs from the Kubernetes Pod logs.
FileBeat later decodes JSON log using decode_json_fields to map each field (such as timestamp, version, message, logger_name, …) to an indexed Elasticsearch field.

<configuration>
    <appender name="jsonConsoleAppender" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>
    </appender>
    <root level="INFO">
        <appender-ref ref="jsonConsoleAppender"/>
    </root>
</configuration>

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingenhancementNew feature or request

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions