Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat-8.1] module is configured with datasets enabled, but unable to setup #30914

Closed
renzedj opened this issue Mar 18, 2022 · 1 comment
Closed
Labels
needs_team Indicates that the issue/PR needs a Team:* label

Comments

@renzedj
Copy link

renzedj commented Mar 18, 2022

I am experiencing the issue described in #29175, where I am unable to load Elastic Ingest pipelines using filebeat setup .... Per the instructions in the referenced issue, I have enabled the modules and set the datasets to enabled (e.g., syslog.enabled: true), however I am still getting the following error when attempting to do the setup, as follows:

filebeat@8d9084383041:~$ filebeat modules enable apache system
Module apache is already enabled
Module system is already enabled
filebeat@8d9084383041:~$ filebeat setup --index-management --pipelines --modules apache,system
Exiting: module apache is configured but has no enabled filesets

Here is the contents of my system.yml file, as an example:

# Module: system
# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-system.html

- module: system
  # Syslog
  syslog:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

  # Authorization logs
  auth:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

Note that I am attempting to use the filebeat container image to execute this (I plan to automate this functionality), however I am mounting a local directory with enabled modules to ${path.config}/modules.d, and have validated that they're showing in the correct place inside the container.

The contents of my filebeat.yml is:

---
filebeat:
  config:
    modules:
      path: '${path.config}/modules.d/*.yml'
      reload:
        enabled: false

setup:
  kibana:
    host: '${KIBANA_URL}'
    protocol: 'https'
    username: '${ELASTIC_ADMIN_USER}'
    password: '${ELASTIC_ADMIN_PASSWORD}'
    ssl:
      enabled: true

  ilm:
    policy_name: 'filebeat-ilm-policy'
    enabled: 'true'
    pattern: '000001'

  template:
    name: 'filebeat'
    pattern: 'filebeat-*'
    settings:
      index:
        final_pipeline: '${SETUP_TEMPLATE_SETTINGS_INDEX_FINAL_PIPELINE:filebeat-final-pipeline}'

output:
  elasticsearch:
    index: 'filebeat-%{[agent.version]}'
    hosts:
      - '${ELASTICSEARCH_URL}'
    protocol: 'https'
    username: '${ELASTIC_ADMIN_USER}'
    password: '${ELASTIC_ADMIN_PASSWORD}'
    ssl:
      enabled: true
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Mar 18, 2022
@botelastic
Copy link

botelastic bot commented Mar 18, 2022

This issue doesn't have a Team:<team> label.

@renzedj renzedj closed this as completed Mar 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs_team Indicates that the issue/PR needs a Team:* label
Projects
None yet
Development

No branches or pull requests

1 participant