search

Graylog2 / collector-sidecar

Manage log collectors through Graylog
https://www.graylog.org/
Other
268 stars 56 forks source link

Filebeat routing message problem #217

Open kakaz opened 6 years ago

kakaz commented 6 years ago

Problem description

Steps to reproduce the problem

  1. Graylog v2.3.1+9f2c6ef
  2. I've defined Collectors working for winlogbeat and filebeat
  3. Winlogbeat gathers Windows Event logs and route it into collector output which transfers them into input working on the same machine on port 5046 ( it works)
  4. filebeats read several text log files ( mostly flexlm license managers) and should route it into collector output which transfers them into input working on the same machine on port 5047
  5. for filebeats there is several files to read, so several collector inputs, one per monitored file
  6. messages are read, and transferred into collector machinery
  7. All messages form filebeat are routed to stream "all messages" and nothing is in input dedicated to license servers on 5047 port.
  8. I've checked generated config for winlogbeat and filebeat. In winlogbeat there is a section with output definition, which points into correct port 5047. On filebeat generated file there is no such line. I've added it manually: then it works ( messages appear in input working on 5047 port ). but when checking on colector's overview --> show messages ( blue button) - messages stil has only routed to: all messages info.

Environment

Collector - manage configurations - beat input image

Collector - manage configurations - beat output: image

Graylog Input configuration: image

Collector --> show messages - filebeat route information ( routed to all messages - wrong) image

Collector --> show messages - winlogbeat route information ( routed to correct stream) image

jalogisch commented 6 years ago

This is connected to https://github.com/Graylog2/collector-sidecar/issues/168