努力让文件运行起来。
根据docs(https://www.elastic.co/guide/en/beats/filebeat/6.1/load-kibana-dashboards.html)仪表板加载是必需的。
所以,在/etc/filebeat/filebeat.yml
setup.dashboards.enabled: true
但现在我得到:
beat.go:625: CRIT Exiting: Error importing Kibana dashboards: fail to create the Elasticsearch loader: Elasticsearch output is not configured/enabled
Exiting: Error importing Kibana dashboards: fail to create the Elasticsearch loader: Elasticsearch output is not configured/enabled
我的印象是Logstash输出就是所需要的,而Logstash负责输出到Elasticsearch。
但是,如果我在filebeat(/etc/filebeat/filebeat.yml
)中启用Elasticsearch输出:
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
我明白了:
beat.go:625: CRIT Exiting: error unpacking config data: more then one namespace configured accessing 'output' (source:'/etc/filebeat/filebeat.yml')
Exiting: error unpacking config data: more then one namespace configured accessing 'output' (source:'/etc/filebeat/filebeat.yml')
我看不到你的配置,但似乎你为Filebeat设置了2个不同的输出,这个服务只接受一个输出,只注释另一个(例如:output.elasticsearch)。然后再次检查配置文件:
filebeat -c /etc/filebeat/filebeat.yml