Filebeat service issue

[Baskaran Gunasekaran]

Hi There,

Filebeat service on and off keeps failing. Can you please help us on this issue. Error status given below.

# systemctl status filebeat
× filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Tue 2022-11-01 03:55:27 UTC; 21min ago
       Docs: https://www.elastic.co/beats/filebeat
    Process: 89302 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=2)
   Main PID: 89302 (code=exited, status=2)
        CPU: 125ms

 

Nov 01 03:55:27 wazuh systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
Nov 01 03:55:27 wazuh systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Nov 01 03:55:27 wazuh systemd[1]: filebeat.service: Start request repeated too quickly.
Nov 01 03:55:27 wazuh systemd[1]: filebeat.service: Failed with result 'exit-code'.
Nov 01 03:55:27 wazuh systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch.

Regards,

Baskaran G

[Aditya Sharma]

Hi Baskaran, Thanks for contacting Wazuh!

Can you please share your filebeat.yml file? Also please check out this document once: https://discuss.elastic.co/t/filebeat-service-failing-to-start/251199/6

Regards
Aditya Sharma

[Baskaran Gunasekaran]

Hi Aditya Sharma,

  I have attached the filebeat.yml file for your reference. I will check this document too.

Regards,

Baskaran G

[Baskaran Gunasekaran]

Hi Aditya,

I have followed the document and issue has been resolved.

Thanks for your support.

Thanks,

Baskaran G

On Tuesday, November 1, 2022 at 12:52:41 PM UTC+5:30 aditya...@wazuh.com wrote: