Filebeat on Windows 2012 R2 - logstash

Question

I am using Filebeat > Logstash > Elasticsearch > Kibana to parse and analyse logs basically Java Stack Trace and other Logs.
Here is YML for Filebeat
filebeat:
prospectors:
-
paths:
- C:\logs\OCR\example.log
input_type: log
#document_type: UAT_EXAMPLE
exclude_lines: [".+DEBUG"]
multiline:
pattern: ".+(ERROR|INFO)"
negate: true
match: after
fields:
app_name: EXAMPLE_APP
environment: UAT
fields_under_root: true
#force_close_files: true
spool_size: 2048
#publish_async: true
#scan_frequency: 10s
#close_older: 2h
output:
logstash:
host: "10.0.64.14"
port: 5044
index: filebeat
timeout: 5
reconnect_interval: 3
bulk_max_size: 2048
shipper:
tags: ["ABC_Engine", "UAT_EXAMPLE"]
queue_size: 1000
### Enable logging of the filebeat
logging:
level: warning
to_files: true
files:
path: c:\logs\
name: mybeat.log
rotateeverybytes: 20485760 # = 20MB
keepfiles: 7
Enable logging of the filebeat is also not working on windows. Let me know if I am missing anything here.
logging:
level: warning
to_files: true
files:
path: c:\logs\
name: mybeat.log
rotateeverybytes: 20485760 # = 20MB
keepfiles: 7
Problem - the Filebeat is not able to send logs to logstash at times, some times it start running shipping but sometimes it doesn't.
Although If I use "test.log" as a prospector and save logs locally on disk via below config it works well.
Writing Files to local File to Check the output. I have tried "file" output and "logstash" output one by one.
output:
file:
path: c:\logs\
filename: filebeat
rotate_every_kb: 100000
number_of_files: 7
Also, The things mostly run when I am using command Line:
.\filebeat.exe -c filebeat.yml -e -v
Kindly assist with the correct config for Windows.
The log file "example.log" is getting rotated on every 30 MB of size.
I am not very sure to use the below attributes and how they will function with Filebeat on Windows.
"close_older"
"ignore_older"
"Logging"

Answer 1

output to logstash :
comment elasticsearch line
then
logstash:
# The Logstash hosts
hosts: ["localhost:5044"]
keep []
and config for log in debug mode for example
logging:
# Send all logging output to syslog. On Windows default is false, otherwise
# default is true.
#to_syslog: true
# Write all logging output to files. Beats automatically rotate files if rotateeverybytes
# limit is reached.
#to_files: false
# To enable logging to files, to_files option has to be set to true
files:
# The directory where the log files will written to.
#path: /var/log/mybeat
path: c:\PROGRA~1/filebeat
# The name of the files where the logs are written to.
name: filebeat.log
# Configure log file size limit. If limit is reached, log file will be
# automatically rotated
rotateeverybytes: 10485760 # = 10MB
# Number of rotated log files to keep. Oldest files will be deleted first.
#keepfiles: 7
# Enable debug output for selected components. To enable all selectors use ["*"]
# Other available selectors are beat, publish, service
# Multiple selectors can be chained.
#selectors: [ ]
# Sets log level. The default log level is error.
# Available log levels are: critical, error, warning, info, debug
level: debug
LOGGING is in LOGGING part, output is logstash or elastic search, if you want know you can install as service go to the elastic.co website :
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html