How to set up beats along with logstash

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

i am trying to configure beats working with logstash, using docker compose. If i don't use logstash then everything works perfectly in kibana's dashboard, but when i use logstash and i open kibana, i get some errors and some visualizations can not be displayed. Here are some of my configurations:

logstash.conf

input {

    beats {

        port => 5044

    }

}



output {

    elasticsearch {

        hosts => "elasticsearch:9200"

        index => "%{[@metadata][beat]}-%{[@metadata][version]}"

    }

}

metricbeat.yml

#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["192.168.1.1:5044"]

Some of the errors i get in kibana are:

Saved "field" parameter is now invalid. Please select a new field.

The request for this panel failed.

Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order

to load fielddata in memory by uninverting the inverted index.

Note that this can however use significant memory. Alternatively use a keyword field instead.

edited Jan 3 at 10:57

asked Jan 3 at 10:49

Grigoris Papoutsis

178

add a comment |

logstash.conf

input {

    beats {

        port => 5044

    }

}



output {

    elasticsearch {

        hosts => "elasticsearch:9200"

        index => "%{[@metadata][beat]}-%{[@metadata][version]}"

    }

}

metricbeat.yml

#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["192.168.1.1:5044"]

Some of the errors i get in kibana are:

Saved "field" parameter is now invalid. Please select a new field.

The request for this panel failed.

Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order

to load fielddata in memory by uninverting the inverted index.

Note that this can however use significant memory. Alternatively use a keyword field instead.

edited Jan 3 at 10:57

asked Jan 3 at 10:49

Grigoris Papoutsis

178

add a comment |

logstash.conf

input {

    beats {

        port => 5044

    }

}



output {

    elasticsearch {

        hosts => "elasticsearch:9200"

        index => "%{[@metadata][beat]}-%{[@metadata][version]}"

    }

}

metricbeat.yml

#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["192.168.1.1:5044"]

Some of the errors i get in kibana are:

Saved "field" parameter is now invalid. Please select a new field.

The request for this panel failed.

Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order

to load fielddata in memory by uninverting the inverted index.

Note that this can however use significant memory. Alternatively use a keyword field instead.

edited Jan 3 at 10:57

asked Jan 3 at 10:49

Grigoris Papoutsis

178

logstash.conf

input {

    beats {

        port => 5044

    }

}



output {

    elasticsearch {

        hosts => "elasticsearch:9200"

        index => "%{[@metadata][beat]}-%{[@metadata][version]}"

    }

}

metricbeat.yml

#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["192.168.1.1:5044"]

Some of the errors i get in kibana are:

Saved "field" parameter is now invalid. Please select a new field.

The request for this panel failed.

Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order

to load fielddata in memory by uninverting the inverted index.

Note that this can however use significant memory. Alternatively use a keyword field instead.

elasticsearch stack logstash kibana elastic-beats

edited Jan 3 at 10:57

asked Jan 3 at 10:49

Grigoris Papoutsis

178

edited Jan 3 at 10:57

asked Jan 3 at 10:49

Grigoris Papoutsis

178

edited Jan 3 at 10:57

asked Jan 3 at 10:49

Grigoris Papoutsis

178

asked Jan 3 at 10:49

Grigoris Papoutsis

178

asked Jan 3 at 10:49

Grigoris Papoutsis

178

add a comment |

0

active

oldest

votes

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54020837%2fhow-to-set-up-beats-along-with-logstash%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

0

active

oldest

votes

0

active

oldest

votes

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu