Filebeat doesn't try to connect to backoff/Logstash and no logs sent to Logstash

Question

I run filebeat on Mac OSX along with sebp/elk docker image . When I tried the same on a windows machine with the exact same configuration, Logs got shipped from Filebeat to Logstash seamlessly. On windows, when I run filebeat before initiating the elk docker container, it keeps retrying to establish a connection with Logstash. On Mac, filebeat is initiating any connection. It doesn't even attempt to connect to backoff/Logstash running on port 5044.

I'm sure I'm missing something really small, can't get it though.I spent almost 2 days on this with no luck.

Answer 1

Did you try executing the debug mode for filbeat to check if:

1. There is any event generated on MacOS device.
2. The log path defined are correct and are being read by the filebeat agent successfuly.

Execute it from the filebeat directory

sudo./filebeat -e -c filebeat.yml -d "*"

Check here for more details