FileBeat configuration test with output

Question

I am trying to test my configuration using filebeat test ouput -e -c filebeat.yml i see only the help message with command list.

I am actually trying to output the data file to verify. Though i have tested filebeat test config -e -c filebeat.yml with ok.

Solution 1

Assuming you're using filebeat 6.x (these tests were done with filebeat 6.5.0 in a CentOS 7.5 system)

To test your filebeat configuration (syntax), you can do:

[root@localhost ~]# filebeat test config
Config OK

If you just downloaded the tarball, it uses by default the filebeat.yml in the untared filebeat directory. If you installed the RPM, it uses /etc/filebeat/filebeat.yml.

If you want to define a different configuration file, you can do:

[root@localhost ~]# filebeat test config -c /etc/filebeat/filebeat2.yml
Config OK

To test the output block (i.e: if you have connectivity to elasticsearch instance or kafka broker), you can do:

[root@localhost ~]# filebeat test output
elasticsearch: http://localhost:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: ::1, 127.0.0.1
    dial up... ERROR dial tcp [::1]:9200: connect: connection refused

In this case my localhost elasticsearch is down, so filebeat throws an error saying it cannot connect to my output block.

The same way as syntax validation (test config), you can provide a different configuration file for output connection test:

[root@localhost ~]# filebeat test output -c /etc/filebeat/filebeat2.yml
logstash: localhost:5044...
  connection...
    parse host... OK
    dns lookup... OK
    addresses: ::1, 127.0.0.1
    dial up... ERROR dial tcp [::1]:5044: connect: connection refused

In this alternative configuration file, my output block also fails to connect to a logstash instance.

Solution 2

-e -c flags must be used before the command "test"

filebeat -e -c filebeat.yml test ouput

 -c, --c argList Configuration file, relative to path.config (default beat.yml)